byt3l0rd/cve-2026-73570Python proof-of-concept for testing SMTP command injection (CVE-2026-73570) by sending malformed RCPT TO addresses to detect shell command substitution in mail servers.
A custom, low-level Python proof-of-concept (PoC) script for testing SMTP command injection vulnerabilities (CVE-2026-73570).
This tool sends a malformed RCPT TO address containing shell-style command substitution (e.g., $(command)) to determine if the target mail server or its downstream processing pipeline improperly passes the address through a shell without sanitization.
⚠️ DISCLAIMER: This tool is intended for educational purposes and authorized security testing ONLY. Ensure you have explicit permission to test the target infrastructure. Unauthorized scanning or exploitation of mail servers is illegal.
GitHub: https://github.com/byt3l0rd/CVE-2026-73570
Author: byt3l0rd0day
Not every Zimbra box is vulnerable. All of these conditions must be true:
zimbra-snmp package is installed (often prompted at installation).snmp_notifyswatchdog service is running (on by default).Attack Surface: The attack does not need SNMP (UDP/161/162) exposed to the attacker. The malicious input arrives over standard SMTP.
The swatchdog process tails /var/log/zimbra.log using configuration from /opt/zimbra/conf/swatchrc.in. It actively matches log entries using the following regular expressions:
/: Service status change: (\S+) (.*) changed from stopped to running/
/: Service status change: (\S+) (.*) changed from running to stopped/