Critical Zimbra flaw linked to email and credential collection activity

Crafted-email exploitation under SNMP conditions

Ars Technica reported that attackers have exploited CVE-2026-73570 in Zimbra Collaboration Suite. The flaw can allow a remote attacker without credentials to execute operating-system commands through a crafted email when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

Microsoft said it observed probing from July 28 to August 7, followed by malicious payload deployment, web shells, remote-access tooling, email access, and collection of authentication and mailbox data. Shadowserver Foundation said its scans found 274 compromised Zimbra instances.

The available report does not provide a comparable pre-exploitation condition for the affected systems.

The reported change is from a disclosed vulnerability to observed exploitation activity, including attempts to obtain email backups and authentication and mailbox data. Microsoft said it could not verify whether the data was successfully exfiltrated.

Distinguishing collection from confirmed exfiltration

The reported activity turns an unauthenticated command-injection flaw in mail-server software into a potential route to email and authentication data. The report also describes affected organizations in more than one region and industry, while leaving successful data exfiltration unverified.