CVE-2026-73570 command injection in Zimbra yields remote code execution
A malformed SMTP recipient is logged and run by Swatchdog as the zimbra user; fix is 10.1.20 or later.
Stories per day · 30 days
3 RSS
Relatedemail3command-injection2cve1ews1impersonation1ldap-injection1rapid71smtp1swatchdog1webshell1zero-click1
19 stories, newest first · one card per story
Stories tagged #zimbra
Attackers exploit Zimbra zero-click flaw CVE-2026-73570 on email servers
Microsoft says crafted mail runs commands when SNMP notifications are on, then webshells and mailbox staging follow; fix is 10.1.20.
5
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Rapid7 details dozens of Zimbra flaws, including mailbox impersonation and cross-user access, with some fixes still missing.
Microsoft catches hackers exploiting Zimbra bug before disclosure
Attackers exploited Zimbra CVE-2026-73570 before disclosure to plant shells, steal mail, and move laterally.
5
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure
Attackers exploited Zimbra CVE-2026-73570 for unauthenticated RCE after patching but before public disclosure.
3
Hackers Exploit Zimbra Mail Servers With Crafted Emails to Gain Remote Access
Attackers are exploiting Zimbra CVE-2026-73570 for unauthenticated command execution and credential theft on exposed mail servers.
4
Zimbra Vulnerability Exploited to Gain Root Access and Steal Mailbox Authentication Secrets
Microsoft details active exploitation of Zimbra CVE-2026-73570 unauthenticated command injection granting root access, web shells, and theft of mailbox authentication secrets.
10
Attackers have been exploiting critical Zimbra flaw to steal emails
Attackers are exploiting critical Zimbra flaw CVE-2026-73570 to steal organizational email and credentials.
3
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Attackers exploit patched Zimbra CVE-2026-73570 to plant web shells and steal mailbox and authentication secrets.
4
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
Microsoft tracks in-the-wild exploitation of unauthenticated Zimbra command injection CVE-2026-73570 on internet-facing mail servers.
10
Zimbra security advisory (AV26-964)
Canada's Cyber Centre urges updates for Zimbra Collaboration Suite releases before 10.1.21 over unspecified vulnerabilities.
When Business Email Compromise Starts Rewriting Reality
Rapid7 and Zimbra research details 50+ Zimbra flaws enabling BEC attacks that impersonate senders, rewrite documents, and manipulate calendars.
Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
CERT Polska and CISA report active exploitation of Zimbra RCE CVE-2026-73570, with 267 instances compromised per Shadowserver.
5
CISA Warns of Zimbra OS Command Injection Vulnerability Active Exploitation (CVE-2026-73570)
CISA added actively exploited Zimbra OS command injection flaw CVE-2026-73570 to its KEV catalog, urging users to patch by August 24, 2026.
1
Unpatched Zimbra servers are falling to CVE-2026-73570 attacks
Attackers are exploiting unpatched Zimbra servers via CVE-2026-73570; 274 instances compromised, and CISA added the flaw to its KEV catalog.
2
Exploited Zimbra Flaw Highlights Shrinking Window to Patch
CISA gave US agencies three days to patch actively exploited Zimbra flaw CVE-2026-73570, which allows full takeover of user communications.
2
U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Zimbra flaw CVE-2026-73570 (unauthenticated OS command injection RCE) to its KEV catalog, setting an August 24, 2026 federal patch deadline.
1
Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw
CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.
1