Zimbra PoCs can miss command injection in Swatchdog
Elastic Security Labs reproduced Zimbra Collaboration’s unauthenticated command-injection flaw, CVE-2026-73570, and found that several public proof-of-concept (PoC) tests can fail even against vulnerable servers.
An attacker sends an SMTP message with a malformed recipient address, which Zimbra writes to its log. Swatchdog, a background monitor, mistakes part of the entry for a service-status command and passes it to the shell. The resulting code runs as the zimbra account, which can read every mailbox and send as any local identity.
For teams using public PoC results to validate Zimbra servers, a failed test leaves patch status unresolved. If a server is compromised, the zimbra account’s access reaches every mailbox and local identity it serves. Elastic’s reproductions show a testing blind spot, not evidence that these PoCs have been used in attacks.
CVSS 8.9 HIGH: a remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. EPSS 72% (99th percentile).
CISA federal remediation date Aug 24 · date passed