Lateral Movement Across Zimbra Clusters via CVE-2026-73570

Overview

A Zimbra deployment is rarely a single host. Mailbox nodes, proxies and supporting services are usually joined into a cluster, and clusters are built on trust. Microsoft's account of the CVE-2026-73570 intrusions shows attackers inheriting that trust and using it as transportation, which is why a single compromised node has to be handled as a cluster-wide event.

The trust the attackers used

Zimbra clusters often authenticate between nodes through a shared SSH key. Having gained a foothold on one server through the unauthenticated command injection, the attackers reused that key to move between nodes. They copied web shells and their own tools with rsync and deleted the source files afterwards, a step that both tidies the origin node and confuses simple file-timeline analysis.

A second campaign's tooling

Microsoft observed a different campaign using a Go-based remote access agent that offered shell access, file transfer and SOCKS5 proxying. A proxy of this kind lets an operator pivot further without necessarily installing anything on the next hop, which complicates host-based detection and shifts more weight onto network monitoring.

Why cluster trust magnifies impact

Shared-key trust is a design convenience: every node can administer every other node. The same property means one successful injection is not one successful intrusion. Where the CVE-2026-73570 web shells were found, copies had also landed on peer mailbox nodes, which is consistent with automated propagation once the shared key was in hand.

Hardening the pivot

Reducing lateral movement in a clustered deployment means treating inter-node trust as a security boundary: scope authorised keys to the operations that are actually required, and treat unexpected rsync activity between mail nodes and unexpected outbound proxy sessions as signals. Replacing a shared key is part of incident response, not an afterthought, because a key reused during an intrusion cannot be trusted afterwards.

Exposure context

ZoomEye shows app="Zimbra" at 210,756 instances, a product fingerprint rather than a confirmed vulnerable population. The CVE-specific query vul.cve="CVE-2026-73570" returned 0.

Remediation

Upgrade to Zimbra 10.1.20 or later and remove zimbra-snmp or disable SNMP notifications if not needed. Then rotate cluster keys and Zimbra service credentials, and sweep every node rather than the first host where a compromise is suspected.

References

• Microsoft Threat Intelligence summary of Zimbra CVE-2026-73570 attacks (SecurityOnline.info report)
• CISA Known Exploited Vulnerabilities Catalog