Zimbra Collaboration RCE Under Active Exploitation
CERT-FR warns that CVE-2026-73570, an RCE-capable flaw in Zimbra Collaboration prior to 10.1.20, is being actively exploited in the wild.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-73570 as exploited in the wild.
The French national CERT (CERT-FR) has issued an advisory covering four vulnerabilities in Synacor's Zimbra Collaboration suite affecting versions prior to 10.1.20. The flaws collectively allow remote code execution, server-side request forgery (SSRF), indirect cross-site scripting (XSS), and a security-policy bypass. ENISA's EU Vulnerability Database has flagged CVE-2026-73570 as actively exploited in the wild, elevating the urgency of patching for organizations running affected Zimbra deployments.
The advisory references three additional CVEs (CVE-2026-10631, CVE-2026-50054, CVE-2026-50055) without detailed technical breakdowns, but groups them under the same set of risk categories. No indicators of compromise, threat actor attribution, or malware associated with the exploitation activity are provided in the advisory. Organizations are directed to Zimbra's August 13, 2026 security bulletin for patches and mitigation guidance.
Given Zimbra's widespread use as an email and collaboration platform for enterprises and government bodies, and the confirmed in-the-wild exploitation of at least one RCE-class vulnerability, affected organizations should prioritize patching to version 10.1.20 or later and monitor for exploitation indicators.
Mentioned in this report
Detection guidance
Zimbra Mailboxd Java Process Spawning Shell or Scripting Interpreter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the Zimbra mailboxd (Java) service unexpectedly spawning a shell or scripting interpreter, a common post-exploitation pattern after RCE against Zimbra Collaboration (e.g. CVE-2026-73570) since the mail server process should not normally launch shells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Zimbra Mailboxd Java Process Spawning Shell or Scripting Interpreter
description: Detects the Zimbra mailboxd/java process spawning a shell or scripting
interpreter, consistent with exploitation of Zimbra Collaboration RCE vulnerabilities
(e.g. CVE-2026-73570) leading to command execution. Generalises on the parent (Zimbra
service) to child (shell/interpreter) relationship rather than any campaign-specific
payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- zimbra
- mailboxd
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /perl
- /python
- /python3
- /nc
filter_known_maintenance:
CommandLine|contains:
- zmcontrol
- zmmailboxdmgr
- logrotate
condition: selection and not filter_known_maintenance
falsepositives:
- Legitimate Zimbra administrative scripts invoking shell helpers during backup, log
rotation, or maintenance windows
- Custom monitoring or health-check scripts that shell out from the mailboxd service
account
level: high
id: e2ec6690-71e7-5e33-9007-a356a6607873
status: experimental
author: Vorant
Web Request to Zimbra Admin or Client Endpoint Followed by File Write in Webroot
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a file being created or modified under the Zimbra web application directories shortly after being served by the mailboxd process, indicative of a webshell drop following exploitation of an RCE vulnerability such as CVE-2026-73570. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Write in Zimbra Web Application Directory by Mailboxd Process
description: Detects mailboxd/Zimbra service processes writing files into web-accessible
application or client directories, which is atypical for normal operation and consistent
with webshell deployment following exploitation of a Zimbra RCE vulnerability.
tags:
- attack.persistence
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
Image|contains:
- zimbra
- mailboxd
TargetFilename|contains:
- /zimbra/jetty
- /zimbra/mailboxd/webapps
TargetFilename|endswith:
- .jsp
- .jspx
- .war
filter_patch_deployment:
TargetFilename|contains: upgrade
condition: selection and not filter_patch_deployment
falsepositives:
- Legitimate Zimbra version upgrades or patch installations that redeploy webapp files
- Custom theme or admin extension deployments performed by administrators
level: high
id: fae6b2d1-1f73-5d34-8a44-d4d03e939548
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1041
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs