Hackers are actively exploiting a severe vulnerability within the Zimbra Collaboration Suite, targeting organizations to gain unauthorized access to email backups and authentication credentials, according to a recent alert from Microsoft. The vulnerability, known as CVE-2026-73570, enables attackers to execute operating system commands remotely without requiring any authentication, posing a significant threat to exposed systems.
The Zimbra maintainer, Synacor, released a patch for this vulnerability on July 20 but did not disclose its existence until over three weeks later. The security organization Shadowserver Foundation reported that its scans identified 274 instances of compromised Zimbra systems. Following the patch’s release, the number of servers running Zimbra software dropped from approximately 19,000 to around 12,000, with current tracking showing about 10,000 instances still active.
Between July 28 and August 7, Microsoft detected multiple scanning tools being deployed by attackers to probe the internet for vulnerable endpoints. These attackers first verified the effectiveness of their exploit through various checks, including HTTP requests and DNS ICMP probes. This reconnaissance allowed them to confirm that the exploit could execute commands on vulnerable servers while remaining undetected. Subsequently, they escalated their operations to utilize command injection capabilities for deploying malicious payloads.
Microsoft outlined that upon successful exploitation, the attackers engaged in activities such as deploying JSP web shells, reverse shells, and persistent remote-access tools. They were also observed collecting sensitive email and authentication data. This operation involved both automated payload deliveries and manual interactions on compromised servers, affecting organizations across multiple regions and industries.
Importantly, CVE-2026-73570 allows remote attackers without any credentials to run commands via crafted emails targeting the ZCS SNMP notification path, contingent upon the presence of an optional zimbra-snmp package and enabled SNMP notifications.
This incident highlights various tactics and techniques from the MITRE ATT&CK framework, particularly focusing on initial access through exploitation of vulnerabilities, persistence via the deployment of web shells, and privilege escalation as attackers seek deeper access into compromised environments. As businesses increasingly leverage collaborative tools like Zimbra, it is crucial for organizations to remain vigilant and implement necessary security patches promptly to mitigate these evolving risks.