Critical Zimbra flaw under active attack

Microsoft has warned that hackers are exploiting CVE-2026-73570, a critical vulnerability in Zimbra Collaboration Suite, to steal email backups and authentication credentials from vulnerable organizations.

Patch delayed, servers still vulnerable

Zimbra maintainer Synacor issued a patch on July twenty, but did not disclose the vulnerability for more than three weeks after that. Shadowserver Foundation found two hundred seventy four compromised instances.

Attackers probe for vulnerable servers

From July twenty eight to August seven, Microsoft detected two distinct scanning tools probing the Internet for vulnerable endpoints. Attackers validated exploits by sending HTTP requests and DNS, I C M P, and out of band identity checks to public services.

Attackers install shells and steal data

After successful exploitation, attackers deployed J S P web shells and reverse shells, escalated privileges, and installed persistent remote access tooling. They accessed email, collected authentication and mailbox data, and created archives for transfer.

“An attacker can send a specially crafted SMTP request that introduces untrusted input into SNMP notification processing.”

Attacks span multiple sectors and regions

Microsoft observed affected organizations in more than one region and industry. Exploitation was not limited to a single sector or geographic area, and the company found no evidence of who the attackers were or their motivations.

Organizations must update immediately

Anyone maintaining Zimbra Collaboration Suite software must ensure they are running version ten point one point twenty or later. Synacor provides additional guidance for locking down systems against further compromise.