--- title: Microsoft catches hackers exploiting Zimbra bug before... description: Microsoft Threat Intelligence tracked attackers exploiting CVE-2026-73570, an unauthenticated command injection vulnerability in Zimbra Collaboration Suite,... canonical: https://daily.dev/posts/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure-zbywegnum twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft catches hackers exploiting Zimbra bug before disclosure | daily.dev og:description: Microsoft Threat Intelligence tracked attackers exploiting CVE-2026-73570, an unauthenticated command injection vulnerability in Zimbra Collaboration Suite,... og:url: https://daily.dev/posts/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure-zbywegnum og:image: https://api.daily.dev/og/posts/zByWEGnUm.png og:image:alt: Microsoft catches hackers exploiting Zimbra bug before disclosure og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft catches hackers exploiting Zimbra bug before disclosure **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary Microsoft Threat Intelligence tracked attackers exploiting CVE-2026-73570, an unauthenticated command injection vulnerability in Zimbra Collaboration Suite, weeks before the flaw was publicly disclosed. The bug affects servers running Zimbra's optional SNMP monitoring package with notifications enabled. Zimbra patched the issue in version 10.1.20 on July 20, but the CVE wasn't disclosed until August 13, giving attackers a head start to scan for and exploit vulnerable internet-facing mail servers. Attackers deployed web shells, escalated privileges to root, moved laterally via SSH trust relationships between Zimbra servers, harvested credentials and mailbox data, and attempted to exfiltrate mailbox backups to Azure Blob Storage using AzCopy. Admins on versions before 10.1.20 should update immediately or disable the SNMP package as a mitigation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-73570 and which Zimbra versions are affected? CVE-2026-73570 is an unauthenticated command injection vulnerability in Zimbra Collaboration Suite affecting internet-facing mail servers running the optional SNMP monitoring package with notifications enabled. An attacker can send a specially crafted email to run commands without needing stolen credentials. Zimbra fixed the flaw in version 10.1.20, released July 20; the CVE was publicly disclosed August 13. _Teams running Zimbra mail infrastructure can follow security advisories like this one on daily.dev to patch before attackers strike._ ### How can I mitigate the Zimbra SNMP command injection vulnerability if I can't patch immediately? Disable SNMP notifications or remove the optional SNMP monitoring package from Zimbra Collaboration Suite, since the command injection flaw (CVE-2026-73570) only affects servers with that package enabled and notifications turned on. The permanent fix is upgrading to Zimbra 10.1.20 or later, which Zimbra released on July 20. _Admins weighing patch-now versus mitigate-later tradeoffs can track Zimbra security updates on daily.dev._ ### How did attackers exploit the Zimbra vulnerability before it had a CVE assigned? Microsoft Threat Intelligence spotted two different scanning tools probing the vulnerable Zimbra code path between July 28 and August 7, more than two weeks before the CVE was publicly disclosed on August 13. Attackers first tested for vulnerable servers using callback techniques, then escalated to deploying web shells, reverse shells, root privilege escalation, lateral movement via SSH trust relationships, and mailbox data theft. _Security teams tracking pre-disclosure exploitation patterns can follow incident writeups like this on daily.dev._ ## Similar posts on daily.dev - [Critical Zimbra security update fixes 9 vulnerabilities](https://daily.dev/posts/critical-zimbra-security-update-fixes-9-vulnerabilities-9ezatfhm8) · CSO Online · 0 upvotes · 0 comments - [ZCS Command Injection via SNMP Handlers Enables Unauthenticated Remote Code Execution](https://daily.dev/posts/zcs-command-injection-via-snmp-handlers-enables-unauthenticated-remote-code-execution-jit2afxha) · InfoQ · 0 upvotes · 0 comments - [Over 10,000 Zimbra servers vulnerable to ongoing XSS attacks](https://daily.dev/posts/over-10-000-zimbra-servers-vulnerable-to-ongoing-xss-attacks-f0dcy8pcn) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft) [View this post on daily.dev](https://daily.dev/posts/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure-zbywegnum) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft catches hackers exploiting Zimbra bug before disclosure","url":"https://daily.dev/posts/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure-zbywegnum","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure-zbywegnum"},"datePublished":"2026-10-01T14:48:02.399Z","dateModified":"2026-10-01T14:49:02.617Z","description":"Microsoft Threat Intelligence tracked attackers exploiting CVE-2026-73570, an unauthenticated command injection vulnerability in Zimbra Collaboration Suite,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/514a9daa658dd13fac7b5c33c89114db?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/514a9daa658dd13fac7b5c33c89114db?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure-zbywegnum","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Microsoft catches hackers exploiting Zimbra bug before disclosure"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure-zbywegnum#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-73570 and which Zimbra versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-73570 is an unauthenticated command injection vulnerability in Zimbra Collaboration Suite affecting internet-facing mail servers running the optional SNMP monitoring package with notifications enabled. An attacker can send a specially crafted email to run commands without needing stolen credentials. Zimbra fixed the flaw in version 10.1.20, released July 20; the CVE was publicly disclosed August 13. Teams running Zimbra mail infrastructure can follow security advisories like this one on daily.dev to patch before attackers strike."}},{"@type":"Question","name":"How can I mitigate the Zimbra SNMP command injection vulnerability if I can't patch immediately?","acceptedAnswer":{"@type":"Answer","text":"Disable SNMP notifications or remove the optional SNMP monitoring package from Zimbra Collaboration Suite, since the command injection flaw (CVE-2026-73570) only affects servers with that package enabled and notifications turned on. The permanent fix is upgrading to Zimbra 10.1.20 or later, which Zimbra released on July 20. Admins weighing patch-now versus mitigate-later tradeoffs can track Zimbra security updates on daily.dev."}},{"@type":"Question","name":"How did attackers exploit the Zimbra vulnerability before it had a CVE assigned?","acceptedAnswer":{"@type":"Answer","text":"Microsoft Threat Intelligence spotted two different scanning tools probing the vulnerable Zimbra code path between July 28 and August 7, more than two weeks before the CVE was publicly disclosed on August 13. Attackers first tested for vulnerable servers using callback techniques, then escalated to deploying web shells, reverse shells, root privilege escalation, lateral movement via SSH trust relationships, and mailbox data theft. Security teams tracking pre-disclosure exploitation patterns can follow incident writeups like this on daily.dev."}}]} ```