CVE-2026-73570: Zimbra Collaboration Suite Command Injection Added to CISA KEV — Detection and Remediation Guide

On August 21, 2026, CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) Catalog: an OS command injection vulnerability in Zimbra Collaboration Suite (ZCS) with confirmed evidence of active exploitation in the wild. For Federal Civilian Executive Branch (FCEB) agencies, this listing triggers mandatory remediation timelines under Binding Operational Directive (BOD) 26-04. For everyone else, the KEV listing is the clearest signal you will get that this bug is being weaponized right now — not theoretically, not in a lab.

If you run internet-facing Zimbra — and Zimbra's entire purpose is to be internet-facing — treat this as an incident, not a patch ticket. Zimbra has been a persistent, high-value target for initial access brokers and state-aligned actors precisely because compromising the mail server yields credential material, sensitive communications, and a trusted pivot point into the rest of the network. Command injection against ZCS is not a new pattern, and defenders should assume operators are already scanning for unpatched instances.

Technical Analysis

What We Know

• CVE: CVE-2026-73570
• Vulnerability class: OS Command Injection (CWE-78)
• Affected product: Zimbra Collaboration Suite (ZCS)
• Exploitation status: Confirmed active exploitation — this is the threshold for KEV inclusion. CISA does not add vulnerabilities to the catalog on speculation.
• Regulatory driver: BOD 26-04 requires FCEB agencies to remediate KEV-listed vulnerabilities on an accelerated timeline.

OS command injection occurs when attacker-controlled input reaches an operating system shell without proper sanitization. In the context of ZCS, the attack surface of concern is the web-facing application tier — the mailboxd Java process and the Zimbra web/proxy stack (nginx) that terminate external client connections. An attacker crafts a malicious HTTP request containing shell metacharacters or command substitution sequences; the vulnerable component passes that input to a system call, and the injected command executes in the context of the zimbra service account.

While zimbra is not root, it is far from harmless: it owns the mail store, the index, user credentials and session tokens, and the local configuration. From a foothold as zimbra, operators historically deploy web shells into the webroot, harvest credentials from the mail store and LDAP, and stage for privilege escalation and lateral movement.

Why Zimbra Command Injection Is a Repeat Offender Pattern

ZCS has a long history of internet-facing injection flaws being exploited at scale for initial access. The operational playbook is consistent: scan for exposed Zimbra instances, exploit the injection, drop a web shell (frequently JSP-based, planted under the webroot served by jetty), harvest mailbox credentials, and either monetize the access directly or broker it. Defenders should assume CVE-2026-73570 is being folded into that same industrial pipeline.

Attack Chain (Defender's View)

1. Reconnaissance: External scanning identifies Zimbra instances via banner, favicon hash, or service fingerprinting on ports 443/7071/8443.
2. Initial access: Crafted HTTP request carrying an OS command injection payload against the vulnerable ZCS component.
3. Execution: Injected command runs as the zimbra user — typically via a shell spawned as a child of the mailboxd/java process.
4. Persistence: JSP web shell written into the Zimbra webroot (commonly under /opt/zimbra/jetty_base/webapps/ or /opt/zimbra/jetty/webapps/), or a cron/systemd persistence mechanism.
5. Collection & pivot: Mailbox and credential access, internal reconnaissance, lateral movement.

The observable artifacts a SOC can actually catch: shells and system utilities spawned by the Zimbra java/mailboxd process, unexpected file writes into the jetty webapps directory, and anomalous POST requests containing shell metacharacters in Zimbra/nginx access logs.

Detection & Response

The detections below target the post-exploitation behaviors that are reliably observable regardless of the exact injection vector: child process execution from the Zimbra service tier, web shell deployment into the webroot, and suspicious request patterns in the proxy logs.

Sigma Rules

---
title: Zimbra Mailboxd Spawning Shell or System Utility
description: Detects the Zimbra java/mailboxd process spawning shells or common post-exploitation utilities, consistent with OS command injection exploitation such as CVE-2026-73570.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
id: 3f7a2c91-8d4e-4b1a-9c6f-2e5d8a1b7c33
status: experimental
date: 2026/08/21
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
    ParentCommandLine|contains:
      - 'mailboxd'
      - 'zimbra'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Zimbra administrative scripts invoking utilities under the zimbra user during maintenance windows
level: high
---
title: Web Shell Written to Zimbra Jetty Webroot
description: Detects creation of JSP or script files in Zimbra jetty webapps directories, a common persistence mechanism following exploitation of ZCS vulnerabilities including CVE-2026-73570.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
id: 9b1e4d62-3a7f-4c8b-8d2a-6f9c1e5b3a44
status: experimental
date: 2026/08/21
logsource:
  product: linux
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '/opt/zimbra/jetty/webapps/'
      - '/opt/zimbra/jetty_base/webapps/'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.sh'
      - '.php'
  condition: selection_path and selection_ext
falsepositives:
  - Zimbra patch or upgrade operations deploying legitimate web application files (correlate with change windows)
level: high

KQL (Microsoft Sentinel / Defender)

This query hunts Zimbra service processes spawning shells or downloader utilities, using Syslog/CEF ingestion from your Zimbra hosts. It also covers file writes into the jetty webroot.

// Hunt: Zimbra mailboxd/java spawning shells or post-exploitation tooling (CVE-2026-73570)
let Lookback = 7d;
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(Lookback)
    | where HostIP in ("<your-zimbra-host-ips>") or Computer has "zimbra"
    | where SyslogMessage has_any ("mailboxd", "/opt/zimbra")
    | where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "nc ", "base64 -d")
    | project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage),
    (CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where DestinationHostName has "zimbra" or DeviceName has "zimbra"
    | where Message has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "/webapps/", ".jsp")
    | project TimeGenerated, DeviceName, SourceIP, DestinationIP, Message)
| order by TimeGenerated desc;

A second query for the web server layer — look for HTTP requests carrying shell metacharacters or command-substitution patterns against Zimbra endpoints. Tune the path filters to your environment; the goal is catching injection payloads in the proxy logs.

// Hunt: Suspicious HTTP requests against Zimbra with shell metacharacters (proxy/firewall via CEF)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (443, 8443, 7071)
| where RequestURL has_any ("$(", "`", "%24%28", "%60", ";id", ";cat%20", "|bash", "%7cbash", "cmd=", "/bin/")
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, RequestURL, DestinationIP
| order by Requests desc;

Velociraptor VQL

Use this hunt artifact on Zimbra hosts to enumerate suspicious child processes of the Zimbra java service and identify recently written script files in the webroot — the two highest-signal forensic artifacts for this threat.

-- Hunt: Zimbra post-exploitation artifacts — suspicious child processes and webroot scripts (CVE-2026-73570)
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
  FROM pslist()
  WHERE CommandLine =~ '(?i)(/bin/(ba)?sh|curl |wget |nc |ncat |base64 -d|python|perl)'
    AND (Username =~ 'zimbra' OR CommandLine =~ 'mailboxd|/opt/zimbra')

LET webshells = SELECT FullPath, Size, Mtime, Ctime
  FROM glob(globs=['/opt/zimbra/jetty/webapps/**/*.jsp',
                   '/opt/zimbra/jetty_base/webapps/**/*.jsp',
                   '/opt/zimbra/jetty/webapps/**/*.sh',
                   '/opt/zimbra/jetty_base/webapps/**/*.sh'])
  WHERE Mtime > now() - 604800

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'FILE_ARTIFACT' AS Name,
       FullPath AS CommandLine, NULL AS Exe, NULL AS Username, Mtime AS CreateTime
FROM webshells

Remediation & Hardening Script

The following Bash script gives your responders a first-pass verification and hardening baseline for Zimbra hosts: confirm the running Zimbra version, enumerate recent webroot modifications, check for anomalous outbound connections, and review recent cron/persistence artifacts. Run it as root on each ZCS node.

#!/bin/bash
# CVE-2026-73570 Triage & Verification — Zimbra Collaboration Suite
# Run as root. Collects version, webroot integrity, and persistence indicators.

echo "=== [1] Zimbra Version (compare against vendor-fixed build) ==="
su - zimbra -c 'zmcontrol -v' 2>/dev/null || echo "Unable to query zmcontrol"

echo "=== [2] Recently modified files in jetty webroot (last 14 days) ==="
find /opt/zimbra/jetty/webapps /opt/zimbra/jetty_base/webapps -type f \
  \( -name '*.jsp' -o -name '*.sh' -o -name '*.php' \) -mtime -14 -ls 2>/dev/null

echo "=== [3] Shells/utilities spawned by zimbra user (from auth/syslog if exec auditing present) ==="
ausearch -u zimbra -x /bin/bash -ts recent 2>/dev/null | tail -50
ausearch -u zimbra -x /bin/sh -ts recent 2>/dev/null | tail -50

echo "=== [4] Persistence check: zimbra and root cron entries ==="
crontab -u zimbra -l 2>/dev/null; crontab -l 2>/dev/null
ls -la /etc/cron.d/ /var/spool/cron/ 2>/dev/null

echo "=== [5] Outbound connections from zimbra-owned processes ==="
ss -tupn 2>/dev/null | grep -i zimbra

echo "=== [6] Nginx access log: requests with shell metacharacters ==="
grep -E '(\$\(|%24%28|%60|;id|%7c|/bin/)' /opt/zimbra/log/nginx.access.log 2>/dev/null | tail -100

echo "=== Triage complete. Preserve logs before patching. If artifacts found, isolate host and initiate IR. ==="

Remediation

1. Patch immediately. Apply the vendor-fixed ZCS release that resolves CVE-2026-73570 as soon as Zimbra publishes it. Consult the official Zimbra security advisories page (https://wiki.zimbra.com/wiki/Security_Center) and the CISA KEV entry for the fixed version and the mandatory remediation deadline. Do not wait for your normal patch cycle — KEV-listed, internet-facing vulnerabilities are the definition of emergency change.
2. FCEB agencies: BOD 26-04 makes this remediation mandatory on CISA's stated due date. Report remediation status per the directive's requirements.
3. Hunt before and after patching. Patching closes the door; it does not evict an intruder already inside. Because exploitation is confirmed active, run the detections above against at least 14 days of retained logs before you patch, and preserve forensic images of any host showing the artifacts described.
4. Reduce exposure. Restrict access to the Zimbra admin console (port 7071) to management networks only — it should never be reachable from the internet. If any ZCS component does not require direct internet exposure, put it behind a VPN or zero-trust gateway.
5. Deploy compensating controls. Place a WAF in front of ZCS with rules blocking shell metacharacters and command-substitution patterns in request URIs and bodies. Enable exec auditing (auditd) for the zimbra user so future exploitation attempts are observable.
6. If compromise is suspected: Isolate the host, rotate all mailbox and administrator credentials, audit mailbox forwarding rules and external sharing (a frequent post-compromise monetization step on mail platforms), and initiate a formal IR process. Assume credential theft once a mail platform is breached.

Analyst's Bottom Line

KEV additions are the shortest possible signal-to-action pipeline in vulnerability management. CVE-2026-73570 is an internet-facing command injection on a platform that stores your organization's most sensitive communications, and adversaries are already using it. The sequence is non-negotiable: hunt first, patch now, verify integrity after. If you find post-exploitation artifacts, you are in incident response, not patch management — escalate accordingly.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub