Attackers have been exploiting critical Zimbra flaw to steal emails
A simple email gives the attackers the ability to remotely inject OS commands.
Cybercriminals have been taking advantage of a serious flaw in the Zimbra Collaboration Suite to steal email data and authentication credentials from affected organizations, according to Microsoft. The vulnerability, identified as CVE-2026-73570, enables unauthorized remote execution of operating system commands. Synacor, the developer of Zimbra, released a patch on July 20, but failed to make the issue public for over three weeks.
Shadowserver Foundation's recent scans revealed that 274 distinct instances of Zimbra were compromised. The number of servers running the software has varied, from 19,000 following the patch to approximately 12,000 in the following weeks. As of now, Shadowserver is monitoring around 10,000 instances. Between July 28 and August 7, Microsoft detected two unique scanning tools targeting the internet for vulnerable endpoints.
The attackers first verified that their exploit was functional by sending HTTP, DNS, ICMP, and out-of-band identity checks to domains hosted on public services. This allowed them to confirm that their exploit could execute commands on vulnerable servers without actually compromising them. Ultimately, the attackers utilized their command injection capability to install malicious payloads.
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
