A critical vulnerability in Zimbra Collaboration Suite (ZCS) was exploited by hackers before its public disclosure, leaving organizations vulnerable to remote code execution attacks. Microsoft has reported that attackers began probing for and exploiting the flaw as early as July 28, just days after patches were released on July 20.
The vulnerability, tracked as CVE-2026-73570 with a CVSS score of 8.9, exists in ZCS versions prior to 10.1.20 due to inadequate sanitization of untrusted input during SNMP notification processing. Specifically, if the zimbra-snmp package is installed and SNMP notifications are enabled, an attacker can trigger the security defect via specially crafted SMTP requests.
Successful exploitation allows unauthenticated attackers to gain remote code execution with the privileges of the Zimbra user. Microsoft observed that hackers used two distinct out-of-band scanning tools to probe for the vulnerable injection point between patching and public disclosure. This reconnaissance activity was later seen during exploitation, as attackers deployed JSP webshells in publicly accessible application directories.
Once inside the system, the attackers mapped clusters, fingerprinted the environment, and escalated privileges to root using legitimate Zimbra tools. They also used Zimbra’s existing SSH identity to access other nodes in the cluster and deployed a secondary persistence mechanism using a systemd service named zimlog.service.
The hackers targeted Zimbra’s centralized service and authentication secrets for credential exfiltration, and used the login material for authenticated LDAP queries that allowed them to retrieve high-value secrets. They also used HTTP and HTTPS callbacks to validate command execution and deployed a full remote-access agent providing interactive shell access, bidirectional file operations, and SOCKS5 proxying.
Zimbra Collaboration Suite users are advised to update their instances to version 10.1.20 or later, uninstall the optional package, disable the vulnerable configuration, restrict SNMP and SMTP access, and check their environments for potential compromise.
This incident highlights the importance of timely patching and secure configuration practices. Organizations should prioritize updating their systems with the latest security patches and ensure that all software components are properly configured to prevent exploitation of vulnerabilities like CVE-2026-73570. Additionally, monitoring for suspicious activity and implementing robust threat detection measures can help identify potential attacks before they cause significant damage.
Source: SecurityWeek — 2026-10-01