Microsoft has reported that attackers are actively exploiting CVE-2026-73570, a critical vulnerability in the Zimbra Collaboration Suite that allows unauthenticated remote execution of operating system commands. The vulnerability affects organizations across multiple industries and geographic regions.
Synacor, the software maintainer, released a patch on July 20, though disclosure of the vulnerability did not occur until more than three weeks later. According to the Shadowserver Foundation, scanning activities detected 274 compromised instances of the Zimbra Collaboration Suite. The number of vulnerable servers running the software has declined from approximately 19,000 in the week after the patch was released to roughly 10,000 currently being tracked.
From July 28 to August 7, Microsoft detected two distinct scanning tools conducting reconnaissance on the internet for vulnerable endpoints. The attackers validated their exploit functionality through HTTP requests and DNS, ICMP, and out-of-band checks using public services, allowing them to confirm successful command execution without initial compromise. Once validated, attackers deployed malicious payloads including JSP web shells, reverse shells, and persistent remote-access tools. The exploitation activity included both automated delivery mechanisms and manual operations on compromised mail servers.
The vulnerability is triggered through specially crafted email messages targeting the ZCS SNMP notification path, but only when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Attackers exploited this by sending SMTP requests that introduce unsanitized input into SNMP notification processing, enabling embedded shell commands to execute with zimbra service account privileges. Following successful exploitation, attackers created email backups and collected authentication and mailbox data, though Microsoft was unable to verify whether data exfiltration occurred.
Maintainers of Zimbra Collaboration Suite are advised to upgrade to version 10.1.20 or later and implement additional system hardening measures.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI