Root Cause

The vulnerability lives in /opt/zimbra/conf/swatchrc.in, inside the dosnmp function responsible for sending SNMP trap notifications when a Zimbra service changes state.

Vulnerable implementation

The vulnerable implementation uses the string form of Perl's system(). The resulting command is interpreted by a shell, allowing shell metacharacters and command substitutions such as $(...) contained in $args{SERVICE} to be evaluated.

Fixed implementation (Zimbra 10.1.20)

The core security fix is switching from string-form to list-form system(), preventing shell interpretation of attacker-controlled data.

With the list form, the executable and its arguments are passed separately. Values such as $(cmd) are treated as literal data instead of shell syntax.

Exploit Chain

The key issue is the complete data flow:

Postfix accepts the specially crafted quoted local-part and records it in zimbra.log. swatchdog subsequently interprets matching log content as a service-status event, allowing attacker-controlled data to reach the vulnerable system() invocation.

Proof of Concept

The following commands were tested only in an isolated lab environment.

Basic PoC — command execution

Connect to the target SMTP service:

Send a specially crafted SMTP transaction:

If exploitation succeeds, /tmp/pwned_rce contains output similar to:

This confirms command execution in the context of the zimbra user.

Reverse Shell

Start a listener on the attacker machine:

Then deliver the payload through SMTP:

Successful exploitation results in an interactive shell running as the zimbra user.

Lab Setup

Requirements

• VirtualBox
• Kali Linux
• Ubuntu Server 22.04 LTS
• Zimbra Collaboration Suite 10.1.0
• Isolated NAT network

Network

Important lab note

The Zimbra 10.1.0 source examined during this research already contained the safe list-form system() implementation.

Therefore, the stock 10.1.0 installation used in this lab was not treated as evidence that Zimbra 10.1.0 itself was vulnerable.

To reproduce the vulnerable condition described by CVE-2026-73570, swatchrc.in was manually modified to use the vulnerable string-form system() implementation.

Backup the original configuration:

The vulnerable behavior can then be reproduced in the isolated lab by applying the string-form implementation shown in the Root Cause section and running swatchdog against the Zimbra log.

Example:

This lab modification exists solely to reproduce and analyze the vulnerable data flow. It should not be interpreted as evidence that the unmodified 10.1.0 build was vulnerable.

Post-Exploitation

Successful exploitation provides command execution as the zimbra user.

Confirm the execution context:

Example:

Zimbra's local configuration can expose credentials available to the compromised service account.

For example:

These credentials may provide access to Zimbra's LDAP directory and demonstrate the post-exploitation impact of obtaining command execution as the zimbra user.

Detection

Search Postfix/Zimbra logs for SMTP recipient entries containing the swatchdog service-status pattern:

A broader search for command-substitution syntax inside quoted local-parts:

Matches should be treated as strong indicators of an exploitation attempt and investigated immediately.

Confirmation of successful command execution requires correlated evidence such as:

• unexpected processes running as zimbra;
• unexpected outbound connections from the server;
• suspicious filesystem artifacts, particularly under /tmp;
• related events in system or application logs.

Mitigation

Primary mitigation

Upgrade Zimbra Collaboration Suite to 10.1.20 or later.

The security fix changes the vulnerable dosnmp() invocation from string-form to list-form system(), preventing attacker-controlled values from being interpreted by a shell.

After patching, review historical logs and system activity for evidence of exploitation that may have occurred while the system was vulnerable.

References

• NVD — CVE-2026-73570
• CISA Known Exploited Vulnerabilities Catalog
• Zimbra Security Advisories
• Zimbra 10.1.20 Release Notes
• RFC 5321 — SMTP

Full technical write-up

https://jpoch.dev/writeups/cve-2026-73570

Video walkthrough

https://www.youtube.com/watch?v=sN1Dt6gu3wY

Disclaimer

This repository contains an independent technical analysis and PoC reproduction of CVE-2026-73570.

It is not the original vulnerability report, and no claim of original discovery is made.

All testing documented here was performed in an isolated lab environment for educational and authorized security research purposes.

Do not use these techniques against systems you do not own or do not have explicit authorization to test.