Recent findings by the Microsoft Security Research team reveal that threat actors have exploited a now-patched vulnerability in the Zimbra Collaboration Suite (ZCS) to deploy web shells and access sensitive mailbox data. This exploitation targets the CVE-2026-73570 vulnerability, a critical unauthenticated operating system command injection flaw with a CVSS score of 8.9 that allows remote code execution when SNMP notifications are enabled and the optional zimbra-snmp package is installed.
Details of the Security Breach
The exploitation of CVE-2026-73570 can be initiated via a specially crafted SMTP request, affecting exposed Zimbra servers without requiring authentication. Zimbra addressed this vulnerability in July 2026 with the release of version 10.1.20. According to Microsoft, successful exploitation has led to the deployment of JSP web shells and reverse shells, privilege escalation, and the use of persistent remote-access tools, with threat actors accessing email and harvesting authentication information.
Global Impact and Discovery
Microsoft observed this attack affecting organizations across multiple regions and industries. Although not all affected hosts exhibited every stage of the attack, the precise identity of the threat actors remains unknown. Initial reports of the active exploitation came from the Polish Computer Emergency Response Team (CERT Polska) in August 2026, which urged users to check for suspicious activity, such as service restarts and file creations in specific directories.
Furthermore, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply necessary patches by August 24, 2026. Microsoft documented attack activities occurring between July 20 and August 13, 2026, with initial reconnaissance using out-of-band scanning tools.
Attack Techniques and Mitigation
Attackers utilized the initial access to execute commands as the “zimbra” service account, deploying multiple JSP web shells and downloading malicious payloads. They maintained persistence through cron jobs, systemd services, and memory-backed execution techniques. In some instances, attackers briefly enabled write access to public directories to deploy web shells, minimizing detection by reverting permissions afterward.
To mitigate these threats, organizations are strongly advised to apply the latest security updates. If patching is not feasible, it’s recommended to remove the zimbra-snmp package, disable SNMP notifications, and limit SNMP and SMTP access to trusted hosts. Additional measures include rotating authentication secrets and scanning for redundant web shell persistence.
Conclusion and Security Recommendations
The exploitation of the Zimbra flaw underscores the importance of timely vulnerability patching and proactive security measures. Organizations must remain vigilant and implement recommended safeguards to prevent unauthorized access and data breaches. By staying informed and responsive, businesses can protect their systems against evolving cybersecurity threats.
