CVE-2026-73570: Zimbra Collaboration Suite Actively Exploited — CISA KEV Addition, Detection and Remediation Guide

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-73570, a vulnerability in Zimbra Collaboration Suite (ZCS), to its Known Exploited Vulnerabilities (KEV) catalog. A KEV listing is not a theoretical warning — it is CISA's formal confirmation that threat actors are actively exploiting this flaw in the wild. That confirmation was echoed this week by CERT Polska, Poland's national computer emergency response team, which reported observed threat actor activity targeting the vulnerability.

I've led incident response engagements against compromised Zimbra infrastructure before, and I'll be direct with you: internet-facing mail and collaboration servers are among the most consistently abused initial access vectors in the threat landscape. Zimbra holds a particularly dangerous position in many environments — it sits on the network edge by design, processes unauthenticated external input (email, web requests), typically runs with broad privileges, and is frequently neglected in patch cycles because administrators fear downtime on business-critical messaging. Attackers know all of this. When a ZCS flaw lands in the KEV, assume scanning and exploitation are already hitting every exposed instance within hours.

If you operate a Zimbra deployment — self-hosted, hosted by an MSP, or running in a DMZ — this is a stop-what-you're-doing moment. Federal civilian agencies are bound by the remediation deadline CISA assigns under Binding Operational Directive 22-01; private-sector organizations should treat that same deadline as their own minimum bar.

Technical Analysis

Affected Product

• Product: Zimbra Collaboration Suite (ZCS) / Zimbra Collaboration — email, calendaring, and collaboration platform
• Exposure surface: Internet-facing ZCS webmail and mailbox services (commonly TCP 443 for the web client and admin console, plus the mail service ports)
• Deployment model: Primarily Linux-based on-premises and VPS-hosted deployments, which also makes ZCS attractive to actors seeking footholds in environments where endpoint detection coverage is historically thin

The Vulnerability

CVE-2026-73570 affects Zimbra Collaboration Suite. At the time of this writing, full public technical details and a finalized CVSS score have not been broadly published — defenders should monitor the official Zimbra Security Center and the NVD entry for the CVE as scoring and affected-version data are finalized. Do not let the absence of a public CVSS number slow your response: inclusion in the CISA KEV catalog means exploitation is confirmed, not hypothetical.

ZCS exploitation historically follows a well-worn pattern, and defenders should posture against it while vendor specifics are finalized:

1. Initial access — attacker sends a crafted request (often via the webmail interface, REST/SOAP endpoints under /service/, or the admin console) to an unpatched, internet-facing ZCS instance.
2. Payload staging — exploitation is used to write files to the web application directory (the Jetty webroot, e.g., /opt/zimbra/jetty/webapps/zimbra/...), frequently a web shell such as a JSP backdoor.
3. Post-exploitation — the web shell is invoked over HTTP(S), spawning child processes from the zimbra service account (/opt/zimbra/jetty JVM) to enumerate, exfiltrate mailbox data (which contains credentials, password resets, and sensitive business communications), deploy additional tooling, or pivot internally.

This chain matters because it gives defenders multiple detection opportunities even without a published exploit signature: webroot file writes, anomalous child processes under the Zimbra JVM, and outbound requests to unexpected URI paths are all observable.

Exploitation Status

• CISA KEV: Listed — confirmed active exploitation
• Independent confirmation: CERT Polska has publicly confirmed threat actor activity targeting this flaw
• Public PoC: Not broadly published at time of writing, but KEV inclusion means working exploit code exists in adversary hands; mass scanning of exposed ZCS instances should be assumed

Detection & Response

The detections below target the post-exploitation behaviors most consistently observed in ZCS compromises: web shell drops into the Jetty webroot, suspicious child processes spawned by the Zimbra Java process, and HTTP requests to abnormal JSP resources. These are durable, behavior-based detections that hold value even as exploit specifics evolve. Tune paths to your deployment (Network Edition paths may differ slightly), and baseline legitimate Zimbra maintenance activity before pushing to production.

Sigma Rules

---
title: Web Shell Dropped in Zimbra Jetty Webroot
id: 3f8a2c61-9b4d-4e71-a5c2-8d6f1b0e9a47
status: experimental
description: Detects creation or modification of JSP/JSPX files inside the Zimbra Collaboration Suite Jetty web application directory, a hallmark of post-exploitation web shell deployment following ZCS compromise such as CVE-2026-73570 exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|startswith:
      - '/opt/zimbra/jetty/webapps/zimbra/'
      - '/opt/zimbra/jetty/webapps/service/'
      - '/opt/zimbra/jetty/webapps/zimbraAdmin/'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate Zimbra patch or package installation updating web application files
level: high
---
title: Suspicious Child Process Spawned by Zimbra JVM
id: 9c1e5b74-2a8f-4d36-b7e0-4f3c6a91d528
status: experimental
description: Detects shells and common post-exploitation utilities spawned as child processes of the Zimbra Jetty Java process, consistent with web shell command execution after exploitation of Zimbra Collaboration Suite vulnerabilities such as CVE-2026-73570.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains: '/opt/zimbra/'
    ParentCommandLine|contains: 'jetty'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Zimbra administration scripts executed by the zimbra user during maintenance windows
  - Legitimate zimlet or extension execution
level: critical
---
title: HTTP Request to Uncommon JSP Resource on Zimbra Host
id: 5d7b0e39-1f6a-4c84-92ab-6e8d3f05c1b9
status: experimental
description: Detects inbound web requests to JSP resources under non-standard paths on Zimbra Collaboration Suite hosts, indicating potential web shell invocation following CVE-2026-73570 exploitation. Baseline legitimate Zimbra JSP paths before deployment.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith:
      - '.jsp'
      - '.jspx'
  filter_known:
    cs-uri-stem|startswith:
      - '/service/'
      - '/zimbra/'
      - '/zimbraAdmin/'
  condition: selection_uri and not filter_known
falsepositives:
  - Custom or third-party Zimlets deploying JSP content under non-standard paths
level: medium

Microsoft Sentinel / Defender KQL

This hunt query assumes your Zimbra hosts ship syslog (and/or auditd process and file events) into Sentinel. It pivots on two behaviors: suspicious child processes spawned by the Zimbra Jetty JVM, and shell/reconnaissance commands executed under the zimbra service account outside normal administrative patterns.

// Hunt for post-exploitation process execution on Zimbra hosts (CVE-2026-73570)
let Lookback = 14d;
let SuspiciousChildren = dynamic(["sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "base64", "whoami", "id", "uname", "iptables"]);
Syslog
| where TimeGenerated > ago(Lookback)
| where Computer has_any ("zimbra", "mail", "zcs") // tune to your Zimbra host naming convention
| where ProcessName in~ (SuspiciousChildren)
| extend Cmd = tostring(SyslogMessage)
| where Cmd has_any ("jetty", "/opt/zimbra/", "zimbra")
    or Cmd has_any ("wget http", "curl http", "base64 -d", "nc -e", "/dev/tcp/", "chmod +x /tmp")
| project TimeGenerated, Computer, ProcessName, HostIP, SyslogMessage
| order by TimeGenerated desc;
// Companion hunt: external HTTP requests hitting uncommon JSP paths on Zimbra hosts
let Lookback2 = 14d;
CommonSecurityLog
| where TimeGenerated > ago(Lookback2)
| where DestinationPort in (443, 8443, 7071) // Zimbra web client, admin console, admin proxy
| where RequestURL endswith ".jsp" or RequestURL endswith ".jspx"
| where RequestURL !startswith "/service/" and RequestURL !startswith "/zimbra/" and RequestURL !startswith "/zimbraAdmin/"
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, RequestURL, DestinationHostName
| order by Hits desc;

Velociraptor VQL

Use this artifact to sweep Zimbra servers for recently created or modified script files inside the Jetty webroot — the highest-fidelity artifact of a successful compromise. Files modified in the last 30 days that do not correspond to a documented patch window are priority investigation targets.

-- Hunt for recently modified executable/web content in Zimbra Jetty webroots (CVE-2026-73570 web shell artifacts)
LET webroots = ['/opt/zimbra/jetty/webapps/zimbra/**', '/opt/zimbra/jetty/webapps/service/**', '/opt/zimbra/jetty/webapps/zimbraAdmin/**']
SELECT FullPath,
       Size,
       Mtime,
       Ctime,
       hash(path=FullPath) AS Hashes
FROM foreach(row=webroots,
query={
  SELECT FullPath, Size, Mtime, Ctime
  FROM glob(globs=_value)
  WHERE FullPath =~ '\\.(jsp|jspx|sh|py|pl)$'
    AND Mtime > (now() - 2592000)  -- last 30 days
})
ORDER BY Mtime DESC

Verification & Hardening Script

Run this on each Zimbra host to audit for compromise indicators and verify patch posture. It does not modify anything — it reports. Review output before taking containment action, and capture it as evidence if indicators are found.

#!/bin/bash
# CVE-2026-73570 — Zimbra CS triage & posture audit (read-only)
# Run as root on the Zimbra host. Redirect output to a file for evidence retention.

echo "=== [1] Zimbra version (verify against vendor advisory for CVE-2026-73570 fixed build) ==="
su - zimbra -c 'zmcontrol -v' 2>/dev/null || grep -i version /opt/zimbra/.install_history 2>/dev/null | tail -5

echo "=== [2] Recently modified web content in Jetty webroots (last 30 days) ==="
find /opt/zimbra/jetty/webapps/ \( -name '*.jsp' -o -name '*.jspx' -o -name '*.sh' -o -name '*.py' -o -name '*.pl' \) -mtime -30 -printf '%T@ %Tc %p\n' 2>/dev/null | sort -rn | head -50

echo "=== [3] Suspicious files in world-writable/staging locations ==="
ls -la /tmp /var/tmp /dev/shm 2>/dev/null | grep -Ei '\.(sh|jsp|elf|py|pl)$|^[a-z0-9]{6,}$' 

echo "=== [4] Child processes currently under Zimbra JVM ==="
ZPID=$(pgrep -f 'jetty' | head -1)
if [ -n "$ZPID" ]; then ps --ppid "$ZPID" -o pid,ppid,user,comm,args; else echo "No jetty process found."; fi

echo "=== [5] Recent outbound connections from zimbra user (unexpected egress = investigate) ==="
ss -tunp 2>/dev/null | grep -E 'java|jetty' | head -20

echo "=== [6] Zimbra access log hits to uncommon JSP paths (last 7 days of logs) ==="
grep -Eh '\.jspx?' /opt/zimbra/log/access_log.* 2>/dev/null | grep -Ev '"/service/|"/zimbra/|"/zimbraAdmin/' | awk '{print $1, $7}' | sort | uniq -c | sort -rn | head -20

echo "=== [7] Unauthorized local accounts / SSH key changes (last 30 days) ==="
find /home /root /opt/zimbra -name 'authorized_keys' -mtime -30 2>/dev/null
awk -F: '($3 >= 1000 || $3 == 0) {print $1}' /etc/passwd

echo "=== DONE — preserve this output and /opt/zimbra/log/ before patching or rebooting ==="

Remediation

1. Patch immediately. Apply the fixed ZCS build per the official Zimbra advisory for CVE-2026-73570. Consult the Zimbra Security Center and the CISA KEV catalog entry for the exact patched version and applicable release streams (8.8.15, 9, and 10.x may each have distinct fixed builds). Because exploitation is confirmed in the wild, treat the CISA-mandated due date as a hard internal deadline regardless of your sector.
2. Hunt before and after patching. Patching closes the door going forward — it does nothing about an intruder already inside. Run the triage script and the Velociraptor hunt above before you patch (to preserve evidence), and continue hunting for 30+ days of historical logs after patching. Web shells dropped pre-patch survive patching.
3. If indicators of compromise are found: isolate the host from the network (do not power off — preserve volatile memory), image the disk, preserve /opt/zimbra/log/, mailbox access logs, and system auth logs, then rebuild from known-good media. Rotate all credentials the server could access: the Zimbra LDAP admin credentials, service accounts, and — critically — end-user mailbox credentials, because mailbox access is a primary objective of these intrusions. Assume password-reset tokens and session cookies in mailboxes were exposed.
4. Restrict the admin console. The ZCS administration interface (default TCP 7071) should never be internet-reachable. Restrict it to a management network or VPN via firewall policy, and verify with an external scan.
5. Reduce edge exposure. Place ZCS behind a reverse proxy or WAF with request inspection, enforce TLS, and apply rate limiting. Ensure the host is not reachable on any port beyond those strictly required for mail flow and client access.
6. Instrument the gaps. Zimbra servers are Linux hosts that frequently lack EDR coverage. At minimum, ship syslog/auditd (process execution and file events) to your SIEM — the detections above depend on it. Consider auditd rules watching /opt/zimbra/jetty/webapps/ for write events as a persistent tripwire.
7. Track the deadline. Check the KEV catalog entry for the BOD 22-01 due date and confirm closure with evidence. If you cannot patch before the deadline, take the instance offline or restrict it behind VPN — an exploitable, internet-facing mail server with a KEV-listed CVE is an assumed breach waiting for confirmation.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub