Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Summary: Microsoft Security Research reported that attackers exploited CVE-2026-73570, an unauthenticated OS command injection flaw in Zimbra Collaboration Suite with a CVSS score of 8.9, triggered by a crafted SMTP request when SNMP notifications are enabled and the zimbra-snmp package is installed. Zimbra patched the flaw in version 10.1.20 in July 2026, and Microsoft observed JSP web shells, reverse shells, privilege escalation, and collection of authentication and mailbox data between July 20 and August 13, 2026.
What you should know: The attackers ran commands as the zimbra service account, deployed redundant web shells, and staged mailbox data into an archive for transfer with AzCopy to an Azure Blob endpoint - and Microsoft said the evidence does not confirm whether that transfer completed, so the exposure may already extend beyond the server itself.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-73570
- Related
- CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability Known Exploited Vulnerabilities · Aug 21, 2026