Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure

What broke in Zimbra Vulnerability Exploited in the Wild

Hackers started exploiting a high-severity OS command injection vulnerability in Zimbra Collaboration Suite (ZCS) shortly after patches were rolled out, before public disclosure, Microsoft reports. Tracked as CVE-2026-73570 (CVSS score of 8.9), the flaw exists because, in ZCS before 10.1.20, untrusted input during SNMP notification processing is improperly sanitized.

Thus, if the zimbra-snmp package has been installed and SNMP notifications have been enabled, an attacker could trigger the security defect via specially crafted SMTP requests. Successful exploitation of the bug allows unauthenticated attackers to achieve remote code execution with the privileges of the Zimbra user.

Who is exposed by Zimbra Vulnerability Exploited in the Wild

Patches for CVE-2026-73570 were rolled out on July 20 in ZCS version 10.1.20, and the vulnerability was publicly disclosed on August 13. See the full write-up from SecurityWeek via the source link for quotes and complete context.

What to do now about Zimbra Vulnerability Exploited in the Wild

“Between July 28 and August 7, after a fix became available on July 20 but before public disclosure on August 13, Microsoft observed two distinct out-of-band scanning tools probing the vulnerable injection point,” Microsoft says. The reconnaissance activity used an execution path that was later seen during exploitation, and was meant to validate command execution via lightweight out-of-band probes, without delivering a payload.

How the Zimbra Vulnerability Exploited in the Wild issue works

As part of the observed follow-up exploitation activity, the attackers deployed JSP webshells to publicly accessible application directories, executed content through wget or curl, launched background processes, and established interactive reverse shells. “Multiple JSP webshells were deployed across Jetty and mailboxd application paths, including additional copies on peer mailbox nodes.

What is still unknown about Zimbra Vulnerability Exploited in the Wild

This provided alternative access paths across different Zimbra configurations and reduced reliance on a single webshell,” Microsoft notes. See the full write-up from SecurityWeek via the source link for quotes and complete context.