A single crafted email can give attackers a shell on an unpatched Zimbra mail server. Microsoft Threat Intelligence has now mapped how attackers exploit Zimbra CVE-2026-73570 in the wild. According to Microsoft's analysis of the unauthenticated command injection, intruders went on to gain root, move across mail clusters, and grab mailbox data. At a Glance Vulnerability

CVE-2026-73570 is an actively exploited unauthenticated command injection vulnerability in Zimbra Collaboration. CISA issued an emergency three-day remediation deadline.