Zimbra CVE-2026-73570 Pre-Disclosure Exploitation Enabled Web Shells and Auth Key Theft via SMTP

The campaign targeted Zimbra Collaboration Suite instances with SNMP notifications enabled and the zimbra-snmp package installed. Exploitation began with crafted SMTP requests that achieved RCE as the zimbra service account. Attackers then mapped deployments with zmprov, modified /etc/pam.d/sudo for passwordless escalation, and deployed redundant JSP shells in Jetty and mailboxd paths while using memfd_create and systemd for persistence. Telemetry from Microsoft and CERT Polska shows two distinct scanning tools probing the injection path in late July, followed by payload delivery via wget and reverse shells. Logs revealed targeted collection of centralized secrets through zmlocalconfig rather than individual mailbox credentials, enabling LDAP queries for high-value authentication attributes. This activity occurred after the July 20 patch release but before the August 13 public disclosure, matching patterns seen in prior mail platform compromises where initial access was monetized for credential harvesting. The absence of attribution evidence leaves open whether the actors were criminal or state-linked, as technical indicators do not align with any public cluster. Organizations must audit zimbra.log for service restarts and inspect webapps directories for unauthorized JSP files. Continued monitoring for anomalous LDAP queries using recovered pre-auth keys remains necessary through the end of 2026.