Zimbra log file injection enables remote code execution via CVE-2026-73570
The claim
An unauthenticated attacker can achieve remote code execution on Zimbra by injecting a crafted log entry that Swatchdog executes.
Published as: “How CVE-2026-73570 turns a Zimbra log file into remote code execution”
So what
Exploiting this flaw gives attackers full control of the mail server and the ability to impersonate users.
The five-minute version
The authors reproduced CVE-2026-73570 on an unpatched Zimbra installation, showing that a malformed SMTP recipient address is logged and then processed by the Swatchdog daemon, which executes the injected command via Perl backticks. They built a working PoC that sends a crafted RCPT TO line, triggers the log pattern, and receives an out-of-band callback confirming code execution as the zimbra user. They also explain why many public PoCs fail and provide an Elastic Defend detection rule to spot the exploitation chain. The evidence consists of a single test system with full command-execution verification.
What they found 2
- CVE-2026-73570 is an unauthenticated command injection vulnerability that can be triggered with a single malformed recipient address.
“CVE-2026-73570 is an unauthenticated command injection vulnerability in Zimbra, and one malformed recipient address is enough to trigger it.”
- Swatchdog builds the service name from log data and executes it via backticks, allowing arbitrary command injection.
“However, the service name is built from $args{SERVICE} and is vulnerable to injection through log messages matching the service format.”
What undercuts it the paper’s own results
- Many public PoCs failed because they wrote payloads that Swatchdog never matches, making the test appear patched.
Stated limits 2
- The only complete fix is upgrading Zimbra to version 10.1.20 or later.
- The detection rule assumes specific process command-line patterns (e.g., sh launched from a Perl Swatchdog script with snmptrap arguments).
What’s new here 4
- Demonstrated the complete RCE chain from SMTP injection to Swatchdog execution.
- Identified why existing public PoCs often fail due to mismatched payload formatting.
- Released a functional PoC with out-of-band callback to verify exploitation.
- Provided an Elastic Defend detection rule for the Swatchdog execution pattern.
Artifacts & methods 4
- Swatchdog daemonprimitive
- Perl backticks in dosnmp functionprimitive
- CVE-2026-73570_poc.py
- Elastic Defend detection rulesystem