Attackers have been exploiting critical Zimbra flaw to steal emails
ars ·
Microsoft has warned that attackers are actively exploiting a critical vulnerability in the Zimbra Collaboration Suite to steal emails and authentication credentials. The flaw, identified as CVE-2026-73570, allows unauthenticated remote command injection through crafted SMTP requests targeting the SNMP notification path. Although maintainer Synacor released a patch on July 20, they withheld disclosure for over three weeks, leaving many systems exposed. Security researchers from Shadowserver Foundation have identified approximately 10,000 compromised instances globally, down from earlier peaks of nearly 19,000. Microsoft observed threat actors deploying web shells, reverse shells, and persistent access tools after gaining initial footholds. These attackers used their elevated privileges to create email backups and collect sensitive mailbox data from affected organizations. The exploitation was not limited to specific industries or geographic regions, indicating a broad scope of impact. Administrators are urged to update to version 10.1.20 or later to mitigate these ongoing risks.
ars