Attackers Exploited Critical Zimbra Vulnerability for Email Theft

Attackers have exploited a critical vulnerability in Zimbra Collaboration Suite (CVE-2026-73570) to steal email backups and authentication credentials, Microsoft has warned.

The flaw allows attackers to remotely issue operating system commands without authentication. Zimbra maintainer Synacor issued a patch on July 20, but the vulnerability remained undisclosed for over three weeks.

The Shadowserver Foundation reported that its scans identified 274 compromised Zimbra instances. The number of servers running the software has since decreased, with approximately 10,000 instances currently being tracked.

Microsoft observed scanning activity between July 28 and August 7, as attackers sought vulnerable endpoints. Exploitation progressed from probing to the installation of malicious payloads.