Zimbra CVE-2026-73570: Patched in July? Check Whether Someone Got In First
Zimbra fixed CVE-2026-73570 in version 10.1.20 on 20 July 2026. The flaw lets anyone who can send mail to a Zimbra server run shell commands on it, with no login and no user action, as long as the optional zimbra-snmp package is installed and SNMP notifications are switched on. On 30 September Microsoft Threat Intelligence published what attackers did with it: web shells, root access, stolen…
Zimbra addressed a critical vulnerability, CVE-2026-73570, in version 10.1.20 on July 20, 2026. This flaw allows an attacker to execute shell commands on a Zimbra server without logging in, provided the optional zimbra-snmp package is installed and SNMP notifications are enabled. Microsoft Threat Intelligence reported that attackers exploited this vulnerability by planting web shells, gaining root access, stealing authentication keys, and creating mailbox archives across multiple regions and industries.
To mitigate the risk, administrators should patch their servers to version 10.1.20 or later and check for any signs of compromise, such as web shells, sudo access, or fake systemd services. If any evidence of an attack is found, it is crucial to rotate all relevant keys, regenerate pre-auth keys, and replace the zimbra SSH key. Additionally, any compromised mailbox contents should be treated as read-only, as the attackers may have already exfiltrated data.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
