Actively Exploited Zimbra Collaboration Suite Flaw Added to CISA KEV — 72-Hour Patching, Detection, and Remediation Guide

---
title: Zimbra Mailboxd Process Spawning Shell or Downloader
tid: 4c1e9b72-8f3a-4d21-b7e6-2a5c8d9f0e1b
status: experimental
description: Detects the Zimbra mailboxd Java process spawning shells or download utilities, consistent with webshell-driven post-exploitation of an exploited Zimbra Collaboration Suite instance.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/opt/zimbra'
      - 'java'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Zimbra maintenance scripts legitimately invoked by the platform (rare under mailboxd; verify command line and parent chain)
level: high
---
title: Webshell File Created in Zimbra Jetty Webapps Directory
tid: 9d2f6a41-3c7b-4e58-a1d4-6b8e0c2f5a93
status: experimental
description: Detects creation of JSP or script files in Zimbra Jetty webapps directories, a hallmark of webshell deployment following exploitation of internet-facing Zimbra flaws.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_creation
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/opt/zimbra/jetty/webapps/'
      - '/opt/zimbra/jetty-distribution'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.sh'
      - '.php'
  condition: selection_path and selection_ext
falsepositives:
  - Zimbra package upgrades write JSP files to these paths; correlate with zmcontrol version changes and patch windows — unexplained writes outside an upgrade window are hostile until proven otherwise
level: high
---
title: Suspicious HTTP Request Patterns Against Zimbra Web Interface
tid: 7b3c8e15-2d4f-4a69-9c21-5e7a1b3d8f46
status: experimental
description: Detects request patterns commonly associated with exploitation and webshell access against Zimbra, including requests to unexpected JSP resources and path traversal sequences, via nginx proxy logs.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri|contains:
      - '../'
      - '..%2f'
      - '%2e%2e'
      - 'WEB-INF'
  selection_webshell:
    cs-uri|contains:
      - '.jsp?'
      - '/public/'
      - '/downloads/'
    cs-method: 'POST'
  condition: 1 of selection_*
falsepositives:
  - Scanner traffic and some legitimate Zimbra mobile sync paths; tune against your baseline and prioritize requests to JSP resources that do not exist in the stock distribution
level: medium

// Hunt for Zimbra exploitation and post-exploitation indicators in Sentinel
// Assumes Zimbra nginx/mailbox logs and Linux auditd/syslog are ingested via Syslog/CEF
let lookback = 14d;
// 1) mailboxd java process spawning shells or downloaders (from auditd/syslog execve)
Syslog
| where TimeGenerated > ago(lookback)
| where Computer has_any ("zimbra", "mail", "zcs")  // tune to your Zimbra host naming
| where SyslogMessage has_any ("/bin/bash", "/bin/sh", "curl ", "wget ", "python", "nc -", "ncat")
| where SyslogMessage has_any ("zimbra", "mailboxd", "java", "/opt/zimbra")
| project TimeGenerated, Computer, SyslogMessage, ProcessName
| order by TimeGenerated desc;
// 2) Web requests to suspicious JSP resources or traversal sequences (Zimbra nginx access logs via CEF/Syslog)
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceProduct has_any ("nginx", "zimbra")
| where RequestURL has_any ("../", "..%2f", "%2e%2e", "WEB-INF", ".jsp")
| extend SourceIP = SourceIP, Method = RequestMethod
| summarize RequestCount = count(), TargetURIs = make_set(RequestURL, 25) by SourceIP, Method, bin(TimeGenerated, 1h)
| where RequestCount > 10
| order by RequestCount desc;

-- Hunt for Zimbra webshells and suspicious child processes of mailboxd
-- Artifact: Zimbra compromise triage (Linux)

-- 1) Recent or unexpected JSP/script files in Jetty webapps directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/opt/zimbra/jetty*/webapps/**/*.jsp', '/opt/zimbra/jetty*/webapps/**/*.jspx', '/opt/zimbra/jetty*/webapps/**/*.sh'])
WHERE Mtime > now() - 2592000  -- modified in last 30 days
ORDER BY Mtime DESC

-- 2) Suspicious child processes spawned under the zimbra service account
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'zimbra'
   AND (CommandLine =~ '(?i)(/bin/(ba)?sh|curl|wget|nc |ncat|python|perl)'
        OR Exe =~ '(?i)(/tmp/|/dev/shm/|/var/tmp/)')

#!/bin/bash
# Zimbra KEV remediation and compromise assessment script
# Run as root on each Zimbra mailbox/proxy node. Review output before acting.

echo "=== [1] Zimbra version check ==="
su - zimbra -c 'zmcontrol -v'

echo "=== [2] Applying available Zimbra patches (OS packages + Zimbra patch channel) ==="
# Zimbra ships security fixes as patch packages; use the official patch mechanism
su - zimbra -c 'zmcontrol stop'
if command -v apt-get >/dev/null 2>&1; then
  apt-get update && apt-get -y upgrade
elif command -v yum >/dev/null 2>&1; then
  yum -y update
fi
# Apply Zimbra-specific patch per the official Zimbra security advisory for this flaw:
# https://wiki.zimbra.com/wiki/Security_Center  and  https://www.zimbra.com/product/security/
su - zimbra -c 'zmcontrol start'
su - zimbra -c 'zmcontrol status'

echo "=== [3] Hunting for webshells in Jetty webapps (files modified in last 60 days) ==="
find /opt/zimbra/jetty*/webapps/ -type f \( -name '*.jsp' -o -name '*.jspx' -o -name '*.sh' \) -mtime -60 -ls

echo "=== [4] Checking for unexpected files in writable temp dirs ==="
find /tmp /var/tmp /dev/shm -user zimbra -type f -mtime -60 -ls 2>/dev/null

echo "=== [5] Reviewing nginx access log for traversal / suspicious JSP requests ==="
grep -Ei '(\.\./|%2e%2e|WEB-INF|\.jsp\?)' /opt/zimbra/log/nginx.access.log | tail -n 200

echo "=== [6] Unexpected zimbra-user shell execution from audit logs ==="
( ausearch -u zimbra -i 2>/dev/null || grep zimbra /var/log/audit/audit.log 2>/dev/null ) | grep -Ei '(bash|sh |curl|wget|python|nc )' | tail -n 100

echo "=== [7] Verifying admin console is not internet-exposed (should only listen on RFC1918/localhost) ==="
ss -tlnp | grep -E '7071|8443'

echo "Done. Any webshell hits in [3]/[4] or suspicious execution in [6] = treat as compromised, isolate the host, and begin IR."