Add vpatch-CVE-2026-73570 rule and test

[crowdsec-automation]

The rule inspects the entire request body for the SMTP command-injection pattern used by the exploit. It requires both an EHLO command containing a shell backtick and the nslookup command used in the supplied payload, reducing false positives from ordinary SMTP traffic and generic backticks.

The original Nuclei template exploits SMTP on TCP port 25 rather than HTTP. Because CrowdSec WAF rules operate on HTTP request zones, the test template represents the SMTP payload inside an HTTP request body so that the detection rule can be exercised. The rule does not rely on the Zimbra web client discovery request because that request is only a version check and is not itself malicious.

Exploit URL: https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-73570.yaml

[github-actions]

Hello @crowdsec-automation,

Scenarios/AppSec Rule are compliant with the taxonomy, thank you for your contribution!

[github-actions]

Hello @crowdsec-automation and thank you for your contribution!

❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection:

🔴 crowdsecurity/vpatch-CVE-2026-73570 🔴

[github-actions]

Hello @crowdsec-automation,

✅ The new VPATCH Rule is compliant, thank you for your contribution!