CVE-2026-73570: Zimbra Collaboration SNMP Command Injection Under Active Exploitation — Detection and Remediation Guide

---
title: Shell Spawned by Zimbra or SNMP Process - Potential CVE-2026-73570 Exploitation
id: 3f8c2a71-9b4d-4e6a-a1c2-7d5e9f0b1234
status: experimental
description: Detects shell interpreters or command execution utilities spawned as children of snmpd or Zimbra service processes, consistent with command injection exploitation of CVE-2026-73570 in Zimbra Collaboration.
references:
  - https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/08/20
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/snmpd'
      - '/snmptrapd'
      - '/zmcontrol'
      - '/java'
  selection_parent_user:
    ParentUser: 'zimbra'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child or (selection_parent_user and selection_child)
falsepositives:
  - Legitimate Zimbra monitoring scripts invoking shell (rare; verify script path and content)
  - Zimbra backup or admin tooling executed interactively
level: high
---
title: Suspicious File Creation in Zimbra Webroot
id: 6a1d4e92-3c7b-4f58-b2d9-8e1a6c4f2345
status: experimental
description: Detects creation of script files (JSP, PHP, shell) in Zimbra web application directories, a common persistence and webshell deployment pattern following remote code execution on ZCS hosts such as via CVE-2026-73570.
references:
  - https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/20
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/opt/zimbra/jetty/webapps/'
      - '/opt/zimbra/jetty_base/webapps/'
      - '/opt/zimbra/data/httpd/htdocs/'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.php'
      - '.sh'
      - '.war'
  condition: selection_path and selection_ext
falsepositives:
  - Zimbra patch installations and upgrades (correlate with change windows)
  - Custom Zimlet deployments by administrators
level: high
---
title: SNMP Service Exposed on Non-Localhost Interface - Zimbra Attack Surface
id: 9c2b7f13-5d8a-4e41-c3f6-1a9d5b7e3456
status: experimental
description: Detects inbound SNMP (UDP 161) connections to Zimbra hosts from non-management source addresses, indicating exposure of the attack surface leveraged by CVE-2026-73570 and potential reconnaissance or exploitation attempts.
references:
  - https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html
  - https://attack.mitre.org/techniques/T1046/
author: Security Arsenal
date: 2026/08/20
tags:
  - attack.discovery
  - attack.t1046
  - attack.initial_access
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort: 161
    Protocol: 'udp'
  filter_mgmt:
    SourceIp|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '172.16.0.0/12'
  condition: selection and not filter_mgmt
falsepositives:
  - External monitoring platforms polling SNMP intentionally (document and allowlist known pollers)
level: medium

// Hunt 1: Shell execution under the zimbra user or snmpd context (post-exploitation of CVE-2026-73570)
let Lookback = 14d;
Syslog
| where TimeGenerated > ago(Lookback)
| where ProcessName in~ ("snmpd", "snmptrapd") or SyslogMessage has "zimbra"
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "chmod +x", "base64 -d", "nc -e", "/dev/tcp/")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 2: Inbound SNMP (UDP/161) to Zimbra hosts from unexpected sources
let ZimbraHosts = dynamic(["zimbra01", "mail01"]); // Replace with your ZCS hostnames
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DestinationPort == 161
| where DestinationHostName in~ (ZimbraHosts) or DeviceName in~ (ZimbraHosts)
| where not(ipv4_is_private(SourceIP))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationHostName, DestinationPort
| order by ConnectionCount desc;

// Hunt 3: Outbound connections from Zimbra hosts to rare destinations (C2 staging after RCE)
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where DeviceName has_any (ZimbraHosts)
| where InitiatingProcessAccountName =~ "zimbra"
| where ActionType == "ConnectionSuccess"
| where not(ipv4_is_private(RemoteIP))
| summarize Connections = count(), Processes = make_set(InitiatingProcessFileName)
    by RemoteIP, RemoteUrl, RemotePort
| order by Connections asc; // Rare, low-volume destinations are the most interesting

-- Hunt: Zimbra SNMP RCE Triage (CVE-2026-73570)
-- Identifies shells under service processes, SNMP listeners on 0.0.0.0, and fresh webroot drops

-- Section 1: Suspicious processes (shells/downloaders) running as zimbra or under snmpd
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Username =~ 'zimbra' OR Name =~ 'snmpd')
  AND (
    Name =~ '^(sh|bash|dash|zsh|curl|wget|nc|ncat|python|python3|perl)$'
    OR CommandLine =~ 'base64|/dev/tcp|chmod \+x|/tmp/'
  )

-- Section 2: SNMP listeners exposed beyond localhost
SELECT Pid, Name, Family, Type, Laddr, Lport, Status
FROM netstat()
WHERE Lport = 161 AND Laddr =~ '^(0.0.0.0|::)$'

-- Section 3: Recently created/modified scripts in Zimbra web directories (last 14 days)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/opt/zimbra/jetty*/webapps/**/*.jsp',
  '/opt/zimbra/jetty*/webapps/**/*.php',
  '/opt/zimbra/jetty*/webapps/**/*.sh',
  '/opt/zimbra/data/httpd/htdocs/**/*'
])
WHERE Mtime > (now() - 1209600)
ORDER BY Mtime DESC

#!/bin/bash
# CVE-2026-73570 Zimbra Triage & Hardening Script - Security Arsenal
# Run as root on each Zimbra Collaboration host. Review output before applying firewall changes.

set -u
REPORT="/root/cve-2026-73570-triage-$(date +%Y%m%d-%H%M%S).log"
exec > >(tee -a "$REPORT") 2>&1

echo "=== [1] Zimbra version ==="
su - zimbra -c 'zmcontrol -v' 2>/dev/null || echo "zmcontrol not found - is this a ZCS host?"
echo "ACTION REQUIRED: Compare against the fixed versions listed in the Zimbra security advisory for CVE-2026-73570."
echo "Advisory hub: https://wiki.zimbra.com/wiki/Security_Center"

echo -e "\n=== [2] SNMP listener exposure (UDP 161) ==="
ss -ulnp | grep -E ':161\b' || echo "No UDP/161 listener found."
echo "If snmpd is bound to 0.0.0.0 or a public interface, restrict it (see step 5)."

echo -e "\n=== [3] IoC sweep: shells spawned by zimbra/snmpd (last 500 process log lines) ==="
ps auxf | grep -E '(snmpd|zimbra)' | grep -E '(sh|bash|curl|wget|nc|python|perl)' | grep -v grep || echo "No suspicious process tree found."

echo -e "\n=== [4] IoC sweep: recent files in Zimbra webroots (last 14 days) ==="
find /opt/zimbra/jetty*/webapps /opt/zimbra/data/httpd/htdocs -type f \
  \( -name '*.jsp' -o -name '*.php' -o -name '*.sh' -o -name '*.war' \) \
  -mtime -14 -ls 2>/dev/null || echo "No recently modified webroot scripts found."

echo -e "\n=== [5] TEMPORARY MITIGATION (only if patching is delayed): restrict SNMP to localhost ==="
echo "Backup snmpd.conf, then enforce local-only binding. Adjust paths for your distro/package."
SNMP_CONF=$(find /opt/zimbra /etc/snmp /etc -maxdepth 4 -name 'snmpd.conf' 2>/dev/null | head -1)
if [ -n "$SNMP_CONF" ]; then
  cp -a "$SNMP_CONF" "${SNMP_CONF}.bak.$(date +%s)"
  echo "Backed up $SNMP_CONF"
  echo "MANUAL STEP: set agentaddress to 127.0.0.1:161 in $SNMP_CONF and restart the SNMP service."
else
  echo "snmpd.conf not found automatically - locate and restrict agentaddress manually."
fi

echo -e "\n=== [6] Firewall: block inbound UDP/161 from non-management sources (iptables example) ==="
echo "iptables -A INPUT -p udp --dport 161 -s <MGMT_CIDR> -j ACCEPT"
echo "iptables -A INPUT -p udp --dport 161 -j DROP"
echo "Replace <MGMT_CIDR> with your monitoring network before applying."

echo -e "\nTriage complete. Report saved to $REPORT"
echo "NEXT STEPS: 1) Patch per Zimbra advisory. 2) If any IoC hits, isolate the host and begin IR - assume webshell persistence and credential theft."