Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Microsoft's security research team reports that attackers have actively abused a now-fixed vulnerability in Synacor's Zimbra Collaboration Suite to plant web shells and steal mailbox and authentication data. The flaw, CVE-2026-73570 (CVSS 8.9), is an unauthenticated OS command-injection bug triggered via a crafted SMTP email when SNMP notifications and the optional zimbra-snmp package are active, requiring no login or user interaction. Zimbra shipped a fix in version 10.1.20 in July 2026, but telemetry shows exploitation occurred between that release and the public disclosure in mid-August, with intruders deploying JSP web shells, reverse shells, cron/systemd persistence, custom Go-based implants (Zimdown2/Zimclient2), and tools to dump LDAP secrets, mailbox databases, and attempt cloud-based exfiltration via AzCopy. CISA has since added the bug to its KEV catalog, and defenders are urged to patch immediately, remove the SNMP package if unpatched, restrict SMTP/SNMP exposure, and rotate Zimbra credentials.