Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure

Microsoft has disclosed that attackers began abusing a high-severity flaw in Zimbra Collaboration Suite (ZCS) before the issue was ever made public. The bug, CVE-2026-73570 (CVSS 8.9), stems from improper sanitization of untrusted input during SNMP notification handling in ZCS versions prior to 10.1.20, and can be triggered via crafted SMTP requests when the zimbra-snmp package and SNMP notifications are active, letting unauthenticated attackers run code as the Zimbra user.

A fix shipped on July 20 in version 10.1.20, but public disclosure didn't happen until August 13. Microsoft says scanning activity probing the flaw began between July 28 and August 7 — weeks before disclosure — followed by real attacks that planted JSP webshells across Jetty and mailboxd directories, created reverse shells, escalated to root through legitimate Zimbra utilities, and set up persistence via a systemd service called zimlog.service. Attackers also harvested centralized Zimbra credentials, ran authenticated LDAP queries for sensitive secrets, and moved laterally using Zimbra's own SSH identity, alongside a full remote-access tool offering shell access, file transfer, and SOCKS5 proxying.

CERT Polska separately flagged exploitation and shared indicators of compromise on August 17. Zimbra administrators are urged to upgrade to 10.1.20 or newer, remove the optional SNMP package if unused, lock down SNMP and SMTP exposure, and inspect systems for signs of compromise.