Attackers have been exploiting critical Zimbra flaw to steal emails

Microsoft has disclosed that attackers have been actively exploiting a severe flaw in Synacor's Zimbra Collaboration Suite, tracked as CVE-2026-73570, to steal email archives and login credentials from vulnerable mail servers. The bug allows unauthenticated remote attackers to execute operating system commands by sending a specially crafted email that abuses the SNMP notification feature, provided the optional zimbra-snmp package is installed and enabled. Although Synacor released a fix on July 20, the vulnerability wasn't publicly disclosed until roughly three weeks later, giving attackers a window to scan for and compromise targets. The Shadowserver Foundation reports 274 compromised instances out of around 10,000 still-exposed Zimbra deployments, with Microsoft observing web shells, reverse shells, privilege escalation, and mass exfiltration of mailbox data across multiple industries and regions.