Attackers exploit Zimbra zero-click flaw CVE-2026-73570 on email servers
Microsoft says crafted mail runs commands when SNMP notifications are on, then webshells and mailbox staging follow; fix is 10.1.20.
84
Product
Zimbra Collaboration Suite
- Mentions · 7d0
- Mentions · 30d4
- All mentions12
- First seenAug 21, 2026
- Last mentioned10d ago
Timeline
12 articles · newest firstFrom One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Rapid7 details dozens of Zimbra flaws, including mailbox impersonation and cross-user access, with some fixes still missing.
71
Microsoft catches hackers exploiting Zimbra bug before disclosure
Attackers exploited Zimbra CVE-2026-73570 before disclosure to plant shells, steal mail, and move laterally.
86
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure
Attackers exploited Zimbra CVE-2026-73570 for unauthenticated RCE after patching but before public disclosure.
78
Attackers have been exploiting critical Zimbra flaw to steal emails
Attackers are exploiting critical Zimbra flaw CVE-2026-73570 to steal organizational email and credentials.
85
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Attackers exploit patched Zimbra CVE-2026-73570 to plant web shells and steal mailbox and authentication secrets.
84
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
Microsoft tracks in-the-wild exploitation of unauthenticated Zimbra command injection CVE-2026-73570 on internet-facing mail servers.
82
Zimbra security advisory (AV26-964)
Canada's Cyber Centre urges updates for Zimbra Collaboration Suite releases before 10.1.21 over unspecified vulnerabilities.
32
CISA Warns of Zimbra OS Command Injection Vulnerability Active Exploitation (CVE-2026-73570)
CISA added actively exploited Zimbra OS command injection flaw CVE-2026-73570 to its KEV catalog, urging users to patch by August 24, 2026.
78
Unpatched Zimbra servers are falling to CVE-2026-73570 attacks
Attackers are exploiting unpatched Zimbra servers via CVE-2026-73570; 274 instances compromised, and CISA added the flaw to its KEV catalog.
78
U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Zimbra flaw CVE-2026-73570 (unauthenticated OS command injection RCE) to its KEV catalog, setting an August 24, 2026 federal patch deadline.
76
Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw
CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.
78
Related CVEs
by mentions- CVE-2026-7357072%8.9Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
- Sieve notify bypasses mail-forward policy in Zimbra
- EWS FindItem Authorization Bypass in Zimbra Collaboration
- LDAP filter injection in Zimbra Collaboration 10.1
- CVE-2026-73571<1%4.3An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending…
- Auth rate-limit bypass in Zimbra Collaboration Suite 10.1
Appears with
- Zimbravendor · 11
- Microsoftorganization · 5
- CISAorganization · 4
- CERT Polskaorganization · 4
- Synacorvendor · 3
- Shadowserver Foundationorganization · 2
- Zimdown2malware · 1
- CERT Polskavendor · 1
- Rapid7organization · 1
- APT28threat actor · 1
- Zimbraorganization · 1
- Microsoftvendor · 1
- Seqrite Labsorganization · 1
- Canadian Centre for Cyber Securityorganization · 1
- Winter Vivernthreat actor · 1
- Synacororganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.