Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Threat actors have been actively exploiting a now-patched vulnerability in Zimbra Collaboration Suite (ZCS), identified as CVE-2026-73570, with a CVSS score of 8.9. The flaw is an unauthenticated operating system command injection vulnerability that enables remote code execution via the Simple Network Management Protocol. Attackers have leveraged this flaw to deploy web shells on compromised systems and harvest authentication secrets from mailbox data. The findings were reported by the Microsoft Security Research team. The attack does not require authentication, making it particularly dangerous for exposed Zimbra instances. Organizations running unpatched versions of ZCS are at significant risk of full compromise. The vulnerability has since been patched, and users are urged to apply updates immediately.