How CVE-2026-73570 turns a Zimbra log file into remote code execution

* CVE-2026-73570 is an unauthenticated command injection vulnerability in Zimbra.
* The vulnerability is triggered by one malformed recipient address in an SMTP request.
* Malformed requests are logged in /var/log/zimbra.log.
* The Swatchdog monitoring daemon matches log entries against a service status pattern.
* An SNMP notification is generated from the mail server to a monitoring host.
* The SNMP notification is parsed with Perl, which invokes commands via backticks.
* Log messages containing invalid address syntax can be manipulated to inject arbitrary shell commands into the execution chain.
* The RCE occurs as the zimbra user.
* Remediation involves upgrading Zimbra to version 10.1.20 or later.
* Detection rules focus on sequences where a shell process is spawned from a Perl process matching specific log patterns without running snmptrap, indicating exploitation.

The vulnerability highlights a systemic failure in how internal logging and external monitoring interact within critical infrastructure. The attack path moves from an application-level error (malformed address) through internal logging, into a monitoring daemon's pattern matching logic, and finally into an execution mechanism via Perl code that interacts with the shell. The fact that publicly available Proofs of Concept often fail suggests that successful exploitation requires a highly specific sequence of log manipulation that current testing methodologies miss; this creates a gap between theoretical vulnerability and practical exploitability. The focus on payload writing failures indicates that defenders must look beyond simply patching the initial flaw and focus on monitoring the subsequent, often less obvious, execution artifacts—specifically tracing legitimate processes like `snmptrap` versus unauthorized shell invocations. This points to the need for context-aware behavioral analytics in security monitoring rather than signature-based matching against static patterns.
Pattern detected: ARC-0043 Motte-and-Bailey
Pattern detected: ARC-0024 Ambiguity