A critical vulnerability in Zimbra Collaboration Suite has been under active exploitation by threat actors seeking to access email data and user credentials, according to a warning issued by Microsoft.
The flaw, designated CVE-2026-73570, permits unauthenticated attackers to remotely execute operating system commands through a specially crafted email message. The vulnerability specifically targets the SNMP notification processing component of Zimbra, but only affects systems where the optional zimbra-snmp package is installed and SNMP notifications are enabled. Synacor, the maintainer of Zimbra, released a patch on July 20, though the vulnerability was not publicly disclosed until more than three weeks after the patch became available. The Shadowserver Foundation reported discovering 274 compromised instances of the software, with tracked instances declining from approximately 19,000 in the week following the patch release to around 10,000 by the time of Microsoft’s advisory.
Microsoft detected two distinct scanning tools probing internet-facing systems for vulnerable Zimbra installations during the period from July 28 to August 7. The attackers employed validation techniques using HTTP requests and DNS and ICMP checks directed at public services to confirm successful exploitation without immediately compromising systems. Following this reconnaissance phase, the threat actors deployed malicious payloads including JSP web shells, reverse shells, and persistent remote-access tools. The attackers subsequently created email backups and harvested authentication and mailbox data, though Microsoft could not verify whether the data was successfully exfiltrated.
The exploitation activity affected organizations across multiple geographic regions and industry sectors, indicating a widespread campaign rather than targeting specific verticals. Microsoft provided no attribution for the attackers and did not specify whether they represented nation-state or financially motivated groups. System administrators managing Zimbra Collaboration Suite deployments are advised to upgrade to version 10.1.20 or later and implement recommended system hardening measures.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI