# Zimbra Collaboration RCE Under Active Exploitation

Published: 2026-08-19 · Severity: high
Canonical: https://vorant.io/reports/01ebf9bc-8587-56df-a367-5ae64f73e2a2/zimbra-collaboration-rce-under-active-exploitation

> CERT-FR warns that CVE-2026-73570, an RCE-capable flaw in Zimbra Collaboration prior to 10.1.20, is being actively exploited in the wild.

The French national CERT (CERT-FR) has issued an advisory covering four vulnerabilities in Synacor's Zimbra Collaboration suite affecting versions prior to 10.1.20. The flaws collectively allow remote code execution, server-side request forgery (SSRF), indirect cross-site scripting (XSS), and a security-policy bypass. ENISA's EU Vulnerability Database has flagged CVE-2026-73570 as actively exploited in the wild, elevating the urgency of patching for organizations running affected Zimbra deployments.

The advisory references three additional CVEs (CVE-2026-10631, CVE-2026-50054, CVE-2026-50055) without detailed technical breakdowns, but groups them under the same set of risk categories. No indicators of compromise, threat actor attribution, or malware associated with the exploitation activity are provided in the advisory. Organizations are directed to Zimbra's August 13, 2026 security bulletin for patches and mitigation guidance.

Given Zimbra's widespread use as an email and collaboration platform for enterprises and government bodies, and the confirmed in-the-wild exploitation of at least one RCE-class vulnerability, affected organizations should prioritize patching to version 10.1.20 or later and monitor for exploitation indicators.

## Mentioned in this report

- Vulnerabilities: CVE-2026-10631, CVE-2026-50054, CVE-2026-50055, CVE-2026-73570 (KEV)

## Detection guidance (public sample)

### Zimbra Mailboxd Java Process Spawning Shell or Scripting Interpreter

ATT&CK: T1190

Detects the Zimbra mailboxd (Java) service unexpectedly spawning a shell or scripting interpreter, a common post-exploitation pattern after RCE against Zimbra Collaboration (e.g. CVE-2026-73570) since the mail server process should not normally launch shells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Zimbra Mailboxd Java Process Spawning Shell or Scripting Interpreter
description: Detects the Zimbra mailboxd/java process spawning a shell or scripting
  interpreter, consistent with exploitation of Zimbra Collaboration RCE vulnerabilities
  (e.g. CVE-2026-73570) leading to command execution. Generalises on the parent (Zimbra
  service) to child (shell/interpreter) relationship rather than any campaign-specific
  payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - zimbra
    - mailboxd
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /curl
    - /wget
    - /perl
    - /python
    - /python3
    - /nc
  filter_known_maintenance:
    CommandLine|contains:
    - zmcontrol
    - zmmailboxdmgr
    - logrotate
  condition: selection and not filter_known_maintenance
falsepositives:
- Legitimate Zimbra administrative scripts invoking shell helpers during backup, log
  rotation, or maintenance windows
- Custom monitoring or health-check scripts that shell out from the mailboxd service
  account
level: high
id: e2ec6690-71e7-5e33-9007-a356a6607873
status: experimental
author: Vorant
```

### Web Request to Zimbra Admin or Client Endpoint Followed by File Write in Webroot

ATT&CK: T1190

Detects a file being created or modified under the Zimbra web application directories shortly after being served by the mailboxd process, indicative of a webshell drop following exploitation of an RCE vulnerability such as CVE-2026-73570. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: File Write in Zimbra Web Application Directory by Mailboxd Process
description: Detects mailboxd/Zimbra service processes writing files into web-accessible
  application or client directories, which is atypical for normal operation and consistent
  with webshell deployment following exploitation of a Zimbra RCE vulnerability.
tags:
- attack.persistence
- attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|contains:
    - zimbra
    - mailboxd
    TargetFilename|contains:
    - /zimbra/jetty
    - /zimbra/mailboxd/webapps
    TargetFilename|endswith:
    - .jsp
    - .jspx
    - .war
  filter_patch_deployment:
    TargetFilename|contains: upgrade
  condition: selection and not filter_patch_deployment
falsepositives:
- Legitimate Zimbra version upgrades or patch installations that redeploy webapp files
- Custom theme or admin extension deployments performed by administrators
level: high
id: fae6b2d1-1f73-5d34-8a44-d4d03e939548
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1041

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/01ebf9bc-8587-56df-a367-5ae64f73e2a2/zimbra-collaboration-rce-under-active-exploitation.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup