How CVE-2026-73570 turns a Zimbra log file into remote code execution

As cited

Copy frozen at 2026-10-23 18:33 UTC (site build).

vulnerabilities

How CVE-2026-73570 turns a Zimbra log file into remote code execution

CVE-2026-73570 is an unauthenticated command injection vulnerability in Zimbra that allows attackers to gain remote code execution by sending a malformed SMTP recipient address. The vulnerability exploits a logging mechanism where Swatchdog, Zimbra's monitoring daemon, processes log entries through Perl backticks and passes unsanitized input to a shell. Organizations running Zimbra versions prior to 10.1.20 face immediate risk, and detection can identify exploitation through process execution patterns spawned from the Swatchdog monitoring script.

Why it matters: Organizations hosting unpatched Zimbra SMTP services are exposed to unauthenticated remote code execution as the zimbra user, enabling attackers to read all mailboxes and impersonate any email identity on the server for lateral movement and persistence; upgrade to version 10.1.20 or later immediately and deploy detection rules to hunt for exploitation.

Source published

2026-10-23 00:00 UTC

First seen by Cybersecurity Tracker

2026-10-23 17:21 UTC