Zimbra OS command injection confirmed exploited in wild
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CVE-2026-73570 Zimbra Collaboration Suite OS command injection is actively exploited; federal agencies must prioritize patching.
CISA has added CVE-2026-73570, an OS command injection vulnerability in Zimbra Collaboration Suite (ZCS), to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. The vulnerability allows attackers to execute arbitrary OS commands on affected systems, granting complete control of the asset post-exploitation. This classification triggers mandatory remediation requirements under BOD 26-04 for Federal Civilian Executive Branch (FCEB) agencies, which must prioritize patching on publicly exposed assets. CISA encourages all organizations regardless of sector to adopt risk-based vulnerability management and treat this as a high-priority patch. Organizations should also check whether their systems were compromised before patching was applied, as attackers are actively exploiting this flaw.
Mentioned in this report
Detection guidance
Zimbra Java Process Spawning Shell With Download or Reverse-Shell Command
Zimbra mailboxd/Jetty Java process spawning a shell that runs download, reverse-shell or encoding commands, consistent with OS command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Zimbra Java Process Spawning Shell With Download or Reverse-Shell Command
description: Detects a Java process running from a Zimbra installation (mailboxd/Jetty)
spawning a shell whose command line contains download, reverse-shell or payload-staging
primitives. This is the typical post-exploitation pattern of OS command injection
in Zimbra Collaboration Suite.
tags:
- attack.execution
- attack.initial-access
- attack.t1651
- attack.t1190
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
ParentCommandLine|contains: zimbra
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- base64
- 'nc '
- ncat
- socat
- python -c
- python3 -c
- perl -e
- chmod +x
- mkfifo
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Custom Zimbra administration extensions that shell out to curl or wget for health
checks
- Zimbra-integrated backup or monitoring scripts launched from the mailbox server
level: high
id: bfab96f9-387a-5485-b00b-2c94b9c162c7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog
Zimbra Service Account Executing Reconnaissance or Network Tooling
Zimbra service account spawning netcat/socat-style tools or interactive recon commands, indicating command execution through a compromised Zimbra service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Zimbra Service Account Executing Reconnaissance or Network Tooling
description: Detects the zimbra service user launching network relay tools or host
reconnaissance utilities that Zimbra does not normally run, which suggests attacker
commands executed through an exploited Zimbra component.
tags:
- attack.execution
- attack.discovery
- attack.t1651
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
User: zimbra
Image|endswith:
- /nc
- /ncat
- /socat
- /whoami
- /nmap
- /telnet
condition: selection
falsepositives:
- Administrators troubleshooting connectivity while switched to the zimbra user (su
- zimbra)
level: medium
id: d3aabf5d-1fc8-5d06-b6f6-fb90be8cfa73
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog
Script File Written to Zimbra Web Application Directory
New JSP/PHP script file created under the Zimbra Jetty webapps directory, a common webshell drop after command injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script File Written to Zimbra Web Application Directory
description: Detects creation of JSP, JSPX or PHP files inside Zimbra Jetty webapps
directories, which is a common webshell placement following remote command execution
on Zimbra. Correlate with patch or upgrade windows to exclude legitimate changes.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1651
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: /jetty/webapps/
TargetFilename|endswith:
- .jsp
- .jspx
- .php
filter_work:
TargetFilename|contains: /jetty/work/
condition: selection and not filter_work
falsepositives:
- Zimbra upgrades and patch installations that deploy new JSP files
- Zimlet deployment by administrators
level: medium
id: e4900c8d-960b-5f61-a467-c539dcc2f0e2
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs