# Zimbra OS command injection confirmed exploited in wild

Published: 2026-08-21 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/a0657b5a-c4a8-5f69-a888-f79a411fa6ce/zimbra-os-command-injection-confirmed-exploited-in-wild

> CVE-2026-73570 Zimbra Collaboration Suite OS command injection is actively exploited; federal agencies must prioritize patching.

CISA has added CVE-2026-73570, an OS command injection vulnerability in Zimbra Collaboration Suite (ZCS), to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. The vulnerability allows attackers to execute arbitrary OS commands on affected systems, granting complete control of the asset post-exploitation. This classification triggers mandatory remediation requirements under BOD 26-04 for Federal Civilian Executive Branch (FCEB) agencies, which must prioritize patching on publicly exposed assets. CISA encourages all organizations regardless of sector to adopt risk-based vulnerability management and treat this as a high-priority patch. Organizations should also check whether their systems were compromised before patching was applied, as attackers are actively exploiting this flaw.

## Mentioned in this report

- Vulnerabilities: CVE-2026-73570 (KEV)

## Detection guidance (public sample)

### Zimbra Java Process Spawning Shell With Download or Reverse-Shell Command

ATT&CK: T1651

Zimbra mailboxd/Jetty Java process spawning a shell that runs download, reverse-shell or encoding commands, consistent with OS command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Zimbra Java Process Spawning Shell With Download or Reverse-Shell Command
description: Detects a Java process running from a Zimbra installation (mailboxd/Jetty)
  spawning a shell whose command line contains download, reverse-shell or payload-staging
  primitives. This is the typical post-exploitation pattern of OS command injection
  in Zimbra Collaboration Suite.
tags:
- attack.execution
- attack.initial-access
- attack.t1651
- attack.t1190
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    ParentCommandLine|contains: zimbra
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - base64
    - 'nc '
    - ncat
    - socat
    - python -c
    - python3 -c
    - perl -e
    - chmod +x
    - mkfifo
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Custom Zimbra administration extensions that shell out to curl or wget for health
  checks
- Zimbra-integrated backup or monitoring scripts launched from the mailbox server
level: high
id: bfab96f9-387a-5485-b00b-2c94b9c162c7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog
```

### Zimbra Service Account Executing Reconnaissance or Network Tooling

ATT&CK: T1651

Zimbra service account spawning netcat/socat-style tools or interactive recon commands, indicating command execution through a compromised Zimbra service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Zimbra Service Account Executing Reconnaissance or Network Tooling
description: Detects the zimbra service user launching network relay tools or host
  reconnaissance utilities that Zimbra does not normally run, which suggests attacker
  commands executed through an exploited Zimbra component.
tags:
- attack.execution
- attack.discovery
- attack.t1651
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    User: zimbra
    Image|endswith:
    - /nc
    - /ncat
    - /socat
    - /whoami
    - /nmap
    - /telnet
  condition: selection
falsepositives:
- Administrators troubleshooting connectivity while switched to the zimbra user (su
  - zimbra)
level: medium
id: d3aabf5d-1fc8-5d06-b6f6-fb90be8cfa73
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog
```

### Script File Written to Zimbra Web Application Directory

ATT&CK: T1651

New JSP/PHP script file created under the Zimbra Jetty webapps directory, a common webshell drop after command injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Script File Written to Zimbra Web Application Directory
description: Detects creation of JSP, JSPX or PHP files inside Zimbra Jetty webapps
  directories, which is a common webshell placement following remote command execution
  on Zimbra. Correlate with patch or upgrade windows to exclude legitimate changes.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1651
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: /jetty/webapps/
    TargetFilename|endswith:
    - .jsp
    - .jspx
    - .php
  filter_work:
    TargetFilename|contains: /jetty/work/
  condition: selection and not filter_work
falsepositives:
- Zimbra upgrades and patch installations that deploy new JSP files
- Zimlet deployment by administrators
level: medium
id: e4900c8d-960b-5f61-a467-c539dcc2f0e2
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a0657b5a-c4a8-5f69-a888-f79a411fa6ce/zimbra-os-command-injection-confirmed-exploited-in-wild.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup