Unpatched Zimbra flaw exploited to steal emails and credentials

A critical security vulnerability in Zimbra Collaboration Suite has been exploited by attackers to access emails and authentication data in organizations across different regions and industries, according to Microsoft. The flaw, identified as CVE-2026-73570, allows remote code execution without authentication when certain configurations are enabled. Although Zimbra issued a patch in July, attackers have used the flaw to install web shells and transfer mailbox archives from unpatched servers.

• Attackers used a critical Zimbra vulnerability to gain server access
• Exploitation lets attackers run commands without authentication
• Web shells and reverse shells were deployed on compromised servers
• Both automated and manual attack methods were observed
• Multiple regions and industries were affected, according to Microsoft