Zimbra Mail Servers Exploited Through Crafted Emails: What CVE-2026-73570 Means for Your Business

Microsoft Threat Intelligence has tracked exploitation of CVE-2026-73570, a flaw in the Zimbra Collaboration Suite that lets an attacker run operating system commands without logging in or needing anyone to click anything. A specially crafted email sent to an internet-facing server can trigger it. The server must have the optional zimbra-snmp package installed and SNMP notifications enabled. Commands run with the privileges of the zimbra service account.

After gaining access, attackers were seen deploying JSP web shells and reverse shells, escalating privileges, setting up persistent remote-access tools, and running code in memory. They also accessed email and collected authentication and mailbox data, then created archives and transferred them out. Microsoft saw both automated payload delivery and hands-on-keyboard activity. Affected organisations were in more than one region and industry, so the activity was not limited to a single sector or geography.

The timeline matters. Zimbra released version 10.1.20 with the fix on July 20, 2026, and the vulnerability was publicly disclosed on August 13, 2026. Between July 28 and August 7, in the gap between those dates, Microsoft observed two distinct scanning tools probing the vulnerable injection point. Attackers were therefore testing for this weakness before public disclosure.