infokom-ki/zimbra-cve-2026-73570-rulesWazuh detection rules for CVE-2026-73570, an OS command injection in Zimbra Collaboration Suite, monitoring web access logs and zimbra.log for exploitation attempts.
| Field | Detail |
|---|
| CVE | CVE-2026-73570 |
| Type | OS command injection |
| Affected | Zimbra Collaboration Suite < 10.1.20 |
| Endpoint | /service/extension/backup/snmptrap (or /service/extension/backup) |
| Injected parameter | snmp_notify |
| Executor | swatchdog (runs the trap notification command) |
| Payload example | 127.0.0.1; id # |
| File | Purpose |
|---|---|
zimbra_cve_2026_73570_rules.xml | Wazuh rules (910100–910103), no custom decoders required |
| ID | Level | Parent | Detection |
|---|---|---|---|
910100 | 6 | - | Request to /service/extension/backup[/snmptrap] |
910101 | 10 | 910100 | snmp_notify= parameter present (exploit trigger) |
910102 | 15 | 910101 | Shell metacharacters in snmp_notify value - exploitation attempt |
910103 | 15 | - | Service status change: with shell metacharacters in /var/log/zimbra.log - command executed |
MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter).
Copy the rules file to the manager:
cp zimbra_cve_2026_73570_rules.xml /var/ossec/etc/rules/
Add the log sources to the agent ossec.conf (<ossec_config> block):
<localfile>
<log_format>apache</log_format>
<location>/opt/zimbra/log/access_log.*</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/zimbra.log</location>
</localfile>
Adjust /opt/zimbra/log/access_log.* to the actual Zimbra/nginx access log
path if it differs.
Restart the manager and agent:
# manager
systemctl restart wazuh-manager
# agent
systemctl restart wazuh-agent
Validate syntax and test against the manager's logtest:
/var/ossec/bin/wazuh-logtest
Paste a sample access-log line (the injection payload) to confirm 910102 fires:
1.2.3.4 - - [26/Feb/2026:10:00:00 +0000] "GET /service/extension/backup/snmptrap?snmp_notify=127.0.0.1%3B+id+%23&snmp_ip=127.0.0.1&snmp_port=162&task=notify HTTP/1.1" 200 1234 "-" "Mozilla/5.0"
910100/910101/910102 fire on web access logs (raw text match, no
decoder dependency). 910103 fires on /var/log/zimbra.log when swatchdog
logs the executed Service status change line.%3B/;, %7C/|, %26/&, %24/$, %60/backtick, %0a/%0d, %23/#).