Zimbra Exploit Tests Produce False Negatives on Vulnerable Servers

Elastic Security Labs reproduced command execution through Zimbra Collaboration’s CVE-2026-73570 and found that several public proofs of concept put text in /var/log/zimbra.log that Swatchdog never matches. A failed test can therefore look like a successful patch. The CVE record scopes the flaw to releases before 10.1.20 with zimbra-snmp installed and SNMP notifications enabled; CISA marks exploitation active in its enrichment of that record.

A malformed SMTP recipient reaches Postfix’s log. Swatchdog matches a service-status line there and inserts the service name into an snmptrap command executed through /bin/sh as the zimbra user. Elastic’s process rule tracks a Swatchdog Perl parent, its shell with snmptrap arguments, and a child process other than snmptrap on the same host within 30 seconds. That last process is the execution signal; a suspicious recipient line alone is a starting point for investigation.

Inventory installed versions and the SNMP configuration, then upgrade affected hosts to 10.1.20 or later. Enable the named Elastic rule with Linux process-start telemetry or monitor the same lineage with another endpoint sensor. Check /var/log/zimbra.log alongside any process matches, and investigate mailbox access and outgoing mail when execution is found. Confirm the installed release after updating. An empty detection search on a host without process telemetry leaves an execution blind spot.