Microsoft Threat Intelligence examines CVE-2026-73570 exploitation in Zimbra, including observed attack paths, detection opportunities, and mitigation guidance.

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team. The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol

Escolha seu player de música preferido!

{{rh9e7yNRO}}

Attention aux utilisateurs de Zimbra ! Des pirates exploitent depuis plusieurs semaines une faille critique du logiciel de messagerie pour voler des

이메일 한 통만 보내도 서버 안의 메일 백업과 인증 정보를 빼낼 수 있는 Zimbra 취약점이 실제 공격에 악용되고 있습니다. 마이크로소프트가 직접 경고에 나설 정도로 심각한 상황인데요, 이미 274곳의 서버가 침해된 것으로 확인됐습니다. 지금 내 서버가 안전한지, 어떻게 확인하고

Microsoft reported that threat actors exploited the patched Zimbra Collaboration Suite flaw CVE-2026-73570 to deploy web shells, gain persistence, and collect mailbox and authentication data across affected organizations. The activity also involved lateral movement, credential theft, and attempted exfiltration using tools such as Zimclient2 and AzCopy, prompting urgent patching and hardening...

Unauthenticated command injection in the SNMP notification path lets hackers steal session tokens and install persistent webshells on mail servers.

A single crafted email can give attackers a shell on an unpatched Zimbra mail server. Microsoft Threat Intelligence has now mapped how attackers exploit Zimbra CVE-2026-73570 in the wild. According to Microsoft's analysis of the unauthenticated command injection, intruders went on to gain root, move across mail clusters, and grab mailbox data. At a Glance Vulnerability

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing.

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing.

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address.

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse.

Russian state-supported actors tracked as LAUNDRY BEAR have been exploiting CVE-2025-66376 in Zimbra Collaboration Suite to steal email data and sensitive account information from Western organizations. The campaign uses a view-based phishing exploit, custom tooling called Ulej, and Flowerbed/Catcher infrastructure to collect and exfiltrate data via DNS and HTTPS. #LAUNDRYBEAR #ZimbraCollaborationSuite...

An urgent alert regarding an actively exploited remote code execution vulnerability affecting the Zimbra Collaboration Suite, a widely used enterprise email and collaboration platform. This vulnerability, tracked as CVE-2026-73570, is an unauthenticated OS command injection issue that allows attackers to execute arbitrary shell commands as the zimbra user. Zimbra RCE Vulnerability The flaw affects Zimbra […]