Summary
- CVE-2026-73570 can be triggered through crafted SMTP input when Zimbra’s optional SNMP package and notifications are enabled.
- Microsoft observed pre-disclosure probing followed by web shells, privilege escalation, credential collection, persistence, and lateral movement.
- Zimbra 10.1.20 contains the fix, but previously exposed servers may require incident investigation in addition to patching.
Attackers exploited an unauthenticated vulnerability in internet-facing Zimbra mail servers to progress from a crafted SMTP request to persistent access, root privileges, credential collection, and attempted theft of mailbox data, according to Microsoft.
CVE-2026-73570 affects the Zimbra Collaboration Suite when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Malicious SMTP input can reach the SNMP notification path and execute operating-system commands with the privileges of the Zimbra service account.
Zimbra version 10.1.20, released on 20 July, contains the remediation. The vulnerability was publicly disclosed on 13 August, but Microsoft says its telemetry identified reconnaissance and activity targeting the same injection path between those dates.
That interval is significant because the fix was available before most defenders had a public vulnerability identifier to drive prioritisation.
Microsoft’s investigation found that successful exploitation went considerably beyond initial command execution. Attackers deployed JSP web shells and reverse shells, established persistent remote-access tooling, escalated privileges, collected Zimbra service credentials and authentication material, mapped server clusters, and moved between trusted mailbox nodes.
In one investigated environment, the attacker abused legitimate Zimbra service helpers and PAM configuration to gain unrestricted sudo access. A disguised systemd service was also installed for persistence.
The attackers targeted central authentication secrets rather than relying only on individual mailbox passwords. Microsoft observed collection of LDAP, database, authentication-token, and pre-authentication material that could extend access across the Zimbra environment.
One payload was designed specifically to collect Zimbra configuration credentials and mailbox information. On another compromised server, attackers staged recent mailbox-backup data locally and attempted to move the archive to Azure Blob Storage. Microsoft says the available evidence does not confirm that particular transfer completed successfully.
Email infrastructure is a high-value target because a mail server can hold years of confidential communication, password-reset messages, calendar data, business records, and authentication material. It can also possess administrative trust relationships with other servers.
Those characteristics make remediation more complex than upgrading the vulnerable package. Once an attacker has obtained root access, installed web shells, created services, or recovered authentication keys, fixing CVE-2026-73570 does not remove those secondary footholds.
Microsoft consequently recommends that affected organisations scope for compromise, rotate sensitive Zimbra secrets, inspect persistence mechanisms, and examine peer nodes rather than assuming one cleaned host represents the full incident.
The case is also a reminder that vulnerability-management timing is not always aligned with disclosure timing. A patch can exist while attackers are already exploring the weakness and before defenders have a public advisory that explains its severity.
Organisations that ran an affected Zimbra configuration during that interval therefore have an incident-response question as well as a patch-management one. Running 10.1.20 or later today does not establish that the server was untouched before the update was installed.
