CTI · reviewed · 2026-08-20

Critical Zimbra RCE flaw now actively exploited in attacks

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1059 Command and Scripting Interpreter Execution

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• 135.136.63.63 ipv4 · active
• 139.28.49.138 ipv4 · active
• 146.70.169.246 ipv4 · active
• 152.53.173.29 ipv4 · active
• 152.53.173.30 ipv4 · active
• 176.65.149.52 ipv4 · active
• 193.24.211.91 ipv4 · active
• 193.32.126.168 ipv4 · active
• 212.132.98.170 ipv4 · active
• 217.154.53.116 ipv4 · active
• 217.154.53.187 ipv4 · active
• 31.177.110.136 ipv4 · active
• 37.32.73.156 ipv4 · active
• 45.90.4.121 ipv4 · active
• 45.90.4.128 ipv4 · active
• 51.91.190.241 ipv4 · active
• 51.91.190.242 ipv4 · active
• 64.62.156.162 ipv4 · active
• 64.62.156.222 ipv4 · active
• 64.62.156.94 ipv4 · active
• 88.214.21.183 ipv4 · active
• 89.116.171.182 ipv4 · active
• 89.117.94.35 ipv4 · active
• gs.thc.org domain · active

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Zimbra SNMP Command Injection CVE-2026-73570
id: c3cc6fcb-092b-40fa-bec3-94a94e4791f2
status: experimental
description: >
    Detects process execution patterns consistent with exploitation
    of CVE-2026-73570, an unauthenticated OS command injection in
    Zimbra Collaboration Suite's SNMP monitoring component (swatchdog
    service). The vulnerability allows arbitrary command execution as
    the zimbra user when SNMP trap notifications are enabled. CERT
    Polska issued Alert 145/2026 on August 17, 2026, confirming
    active exploitation.
references:
    - https://www.cert.pl/en/news single/zimbra-cve-2026-73570
    - https://www.securityweek.com/zimbra-update-patches-critical-vulnerabilities/
author: Tia N. List
date: 2026/08/20
tags:
    - attack.t1190
    - attack.t1059
logsource:
    category: process_creation
    product: linux
detection:
    selection_zimbra_user:
        User: 'zimbra'
    selection_suspicious_commands:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/python'
            - '/perl'
            - '/wget'
            - '/curl'
            - '/nc'
            - '/ncat'
    selection_swatchdog_parent:
        ParentImage|contains: 'swatchdog'
    condition:
        selection_zimbra_user and selection_suspicious_commands and not selection_swatchdog_parent
falsepositives:
    - Legitimate zimbra service maintenance performed by administrators
    - Zimbra health check scripts that spawn shell interpreters
level: high

References

• https://www.cert.pl/en/news single/zimbra-cve-2026-73570