Vulnerabilities · 19h ago

Zimbra PoCs can miss command injection in Swatchdog

Elastic Security Labs reproduced Zimbra Collaboration’s unauthenticated command-injection flaw, CVE-2026-73570, and found that several public proof-of-concept (PoC) tests can fail even against vulnerable servers.

An attacker sends an SMTP message with a malformed recipient address, which Zimbra writes to its log. Swatchdog, a background monitor, mistakes part of the entry for a service-status command and passes it to the shell. The resulting code runs as the zimbra account, which can read every mailbox and send as any local identity.

For teams using public PoC results to validate Zimbra servers, a failed test leaves patch status unresolved. If a server is compromised, the zimbra account’s access reaches every mailbox and local identity it serves. Elastic’s reproductions show a testing blind spot, not evidence that these PoCs have been used in attacks.

CVE-2026-73570

NVD KEV

Known exploited · CISA KEV

CVSS 8.9 HIGH: a remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. EPSS 72% (99th percentile).

CISA federal remediation date Aug 24 · date passed

Timeline

Oct 23 Reported by Elastic Security Labs
Aug 24 CISA federal deadline for CVE-2026-73570 passed
Aug 21 CVE-2026-73570 added to CISA KEV

Sources

1 source covering this story

Elastic Security Labs Oct 23
Zimbra command injection vulnerability, CVE-2026-73570
How the command injection vulnerability works, plus the detection rule.

Entities

CVE-2026-73570

Part of the PlainSec briefing for 2026-10-23

Editions

Briefing for 2026-10-23

Vulnerabilities · 19h agoZimbra PoCs can miss command injection in SwatchdogElastic Security Labs reproduced Zimbra Collaboration’s unauthenticated command-injection flaw, CVE-2026-73570, and found that several public proof-of-concept (PoC) tests can fail even against vulnerable servers.An attacker sends an SMTP message with a malformed recipient address, which Zimbra writes to its log. Swatchdog, a background monitor, mistakes part of the entry for a service-status command and passes it to the shell. The resulting code runs as the zimbra account, which can read every mailbox and send as any local identity.For teams using public PoC results to validate Zimbra servers, a failed test leaves patch status unresolved. If a server is compromised, the zimbra account’s access reaches every mailbox and local identity it serves. Elastic’s reproductions show a testing blind spot, not evidence that these PoCs have been used in attacks.