Microsoft has disclosed that threat actors have been actively exploiting CVE-2026-73570, a critical vulnerability in Zimbra Collaboration Suite that enables unauthenticated remote command execution. The flaw affects systems with the optional zimbra-snmp package installed and SNMP notifications enabled, allowing attackers to inject malicious commands through specially crafted SMTP requests targeting the ZCS SNMP notification processing path.
Synacor, the software maintainer, released a patch on July 20, though the vulnerability remained undisclosed for more than three weeks following the fix. The Shadowserver Foundation identified 274 compromised instances of the software. Server deployment numbers have declined over time, with scans showing approximately 19,000 instances running the software in the week after patching, dropping to around 10,000 by the time of Microsoft’s warning.
Between July 28 and August 7, Microsoft detected two distinct scanning tools probing Internet-connected endpoints for vulnerable systems. Attackers initially validated their exploits by sending HTTP requests and DNS and ICMP probes to public services, confirming successful command execution without directly compromising servers. Following validation, threat actors deployed JSP web shells and reverse shells, conducted privilege escalation, and installed persistent remote-access tools.
Once systems were compromised, attackers accessed email systems and collected authentication credentials and mailbox data. Microsoft documented archive creation and data transfer activity, noting that exploitation involved both automated payload delivery and manual operations on compromised mail servers. The company confirmed that affected organizations spanned multiple regions and industries, with no limitation to a single geographic area or sector.
Microsoft could not verify whether attackers successfully exfiltrated collected data and provided no information regarding the identity or motivation of the threat actors. Organizations operating ZCS are advised to upgrade to version 10.1.20 or later and implement additional system hardening measures recommended by the vendor.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI