Critical Zimbra flaw exploited to steal emails
Original: Attackers have been exploiting critical Zimbra flaw to steal emails
Why This Matters
ZCS is widely used in enterprise and government; unauthenticated email theft at scale is high-impact.
Attackers are exploiting CVE-2026-73570, a critical unauthenticated RCE flaw in Zimbra Collaboration Suite, to install web shells and steal email data. Microsoft warns 274 servers are confirmed compromised out of ~10,000 exposed instances.
Microsoft has warned that threat actors are actively exploiting CVE-2026-73570, a critical unauthenticated command injection flaw in the Zimbra Collaboration Suite (ZCS). The vulnerability allows attackers to remotely execute OS commands by sending a specially crafted email that targets the ZCS SNMP notification path — but only when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
Synacor, Zimbra's maintainer, patched the flaw on July 20 but waited over three weeks before disclosing it publicly. Between July 28 and August 7, Microsoft detected two distinct scanning tools sweeping the internet for vulnerable endpoints, using HTTP, DNS, ICMP, and out-of-band identity checks to confirm exploitation before deploying payloads.
Successful attacks led to JSP web shell and reverse shell deployment, privilege escalation, persistent remote-access tooling, and memory-backed execution. Attackers accessed mailboxes and harvested authentication credentials, with archive creation and data transfer activity observed. The Shadowserver Foundation has confirmed 274 compromised instances; the total pool of exposed servers has shrunk from roughly 19,000 post-patch to about 10,000 today. Affected organizations span multiple regions and sectors. Microsoft has not attributed the attacks to any specific group.