Attackers exploited Zimbra flaw to access email and authentication data

• The flaw let attackers run commands on affected Zimbra servers without logging in, if a particular optional component and setting were enabled.
• Microsoft observed web shells, remote-access tools and collection of email and authentication data across investigated compromises.
• One observed server had mail data archived and an attempted transfer; Microsoft could not confirm that the data arrived.
• Zimbra released a fix on 20 July. Shadowserver later detected compromise artifacts on 274 instances in scans dated 22 August.

Microsoft Threat Intelligence says attackers exploited CVE-2026-73570, a command-injection flaw in Zimbra Collaboration Suite, to gain access to mail servers. Its investigation found attackers accessing email and collecting authentication and mailbox data, alongside activity to archive and transfer files. But observing a transfer attempt is not proof that stolen data reached the attackers. ^{1 2}

The vulnerability is in Zimbra’s SNMP notification path. A specially crafted email can feed commands into that process, allowing them to run without authentication as the Zimbra service account. Exploitation depends on the optional zimbra-snmp package being installed and SNMP notifications being enabled; not every unpatched installation necessarily meets those conditions. ^{1 3}

Microsoft observed reconnaissance probing the vulnerable path between 28 July and 7 August. Zimbra had released version 10.1.20, which it says fixes the flaw, on 20 July. Microsoft dates the CVE’s public disclosure to 13 August; Zimbra’s release announcement refers to an earlier security advisory dated 26 June. Those are distinct milestones in the sources’ accounts. ^{1 4}

In the compromises it investigated, Microsoft found attackers installing web shells and reverse shells, escalating privileges, and setting up persistent remote access. It also described collection of service credentials and authentication keys, which could give intruders access beyond a single mailbox. The report combines activity from multiple confirmed compromises: it does not say every server experienced every step. ¹

On one server, Microsoft found mailbox-backup content archived and AzCopy, a file-transfer tool, used in an attempt to send it to cloud storage. Microsoft could not verify that the transfer completed. Ars Technica, reporting on Microsoft’s findings, likewise said the company could not confirm successful exfiltration. ^{1 2}

There is a separate, dated indicator of the campaign’s reach. Shadowserver said scans on 22 August found artifacts of probable compromise on 274 Zimbra instances, in work with CERT Polska. That is a count of instances showing artifacts—not a confirmed count of organisations, people affected or successful thefts. ^{5 6}

CERT Polska warned of active exploitation on 17 August and advised administrators to check Zimbra logs and update. Zimbra’s release announcement recommends version 10.1.20; Microsoft also advises upgrading to that version or later. Installing a fix closes this vulnerability, but does not by itself establish whether a server was compromised before it was patched. ^{3 4 1}

Footnotes

1. Microsoft Threat Intelligence, “Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570” ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

2. Ars Technica, “Attackers have been exploiting critical Zimbra flaw to steal emails” ↩ ↩²

3. CERT Polska, advisory on active exploitation of the Zimbra Collaboration Suite vulnerability ↩ ↩²

4. Zimbra, “Patch Release Update: Zimbra 10.1.20” ↩ ↩²

5. The Shadowserver Foundation, statement on Zimbra compromise artifacts detected on 22 August ↩

6. The Shadowserver Foundation, Compromised Website Report ↩