Security
Critical Zimbra flaw exposes thousands of email servers to unauthenticated command attacks
Attackers have been actively exploiting a zero-auth vulnerability in Zimbra's email platform to steal messages, credentials, and deploy malicious tools across internet-facing servers.
Ars Technica
Cybercriminals have actively weaponized a critical flaw in the Zimbra Collaboration Suite to breach email systems and pilfer sensitive data, Microsoft warned this week. The vulnerability allows unauthorized actors to execute arbitrary system commands on vulnerable mail servers, bypassing all authentication checks.
The vulnerability and its timeline#
Tracked as CVE-2026-73570, the flaw exists in how Zimbra processes specially crafted emails targeting its SNMP notification system — but only when the optional zimbra-snmp package is active and SNMP alerts are configured. Synacor, which maintains the suite, released a patch on July 20, yet remained silent about the security issue for over three weeks. In the weeks since the fix became public, the number of unpatched Zimbra instances dropped from roughly 19,000 to approximately 10,000, according to the Shadowserver Foundation, which tracks internet-exposed systems. At least 274 servers had already been compromised.
How attackers are exploiting it#
Between late July and early August, Microsoft detected two distinct scanning campaigns probing for vulnerable servers. Attackers first tested whether their exploit worked by sending HTTP requests and DNS queries to validate command execution on target systems before launching full attacks. Once they confirmed successful penetration, the campaign escalated dramatically.
Following successful exploitation, the threat actors took several steps:
- Deployed JSP web shells and reverse shells for persistent access
- Escalated privileges within compromised systems
- Installed malware for long-term remote control
- Harvested email messages, authentication tokens, and mailbox data
- Created archives and transferred stolen data externally
Microsoft noted that the attacks combined automated payload injection with hands-on-keyboard operations where attackers manually conducted further attacks. Organizations across multiple sectors and regions fell victim, suggesting the campaign targeted indiscriminately rather than focusing on specific industries.
