Act
archived
Zimbra CVE-2026-73570 Exploited: Web Shells and Credential Theft
- Engineer — Act: CISA KEV-listed, public PoC active, CVSS 8.9 unauthenticated RCE via SNMP path — patch Zimbra Collaboration Suite to the vendor-released fixed version immediately and audit Zimbra webroot directories for newly created or modified web shell files.
- SOC/IR — Act: Active exploitation confirmed with web shell staging and authentication secret harvesting; hunt for unexpected child processes spawned from the Zimbra service account since late September and sweep Zimbra webroot paths for recently written .jsp/.php files indicative of web shell deployment.
- Leader — Act: CISA KEV listing for an unauthenticated RCE in a widely-deployed enterprise mail platform with confirmed credential harvesting — confirm whether Zimbra is in your environment, verify patching status with the infrastructure team, and assess whether harvested mailbox credentials could expose sensitive communications or escalate to broader account compromise.
- Signals: CVE-2026-73570 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.