Zimbra flaw CVE-2026-73570 is being exploited: update to 10.1.20 and check for intrusions

Zimbra flaw CVE-2026-73570 is being exploited: update to 10.1.20 and check for intrusions

1 October 2026: A command-injection flaw in the Zimbra Collaboration email server was probed by attackers and then used to break into mail servers. Microsoft Threat Intelligence published its findings on 30 September 2026, and SecurityWeek and The Register reported them on 1 October.

Not yet independently verified. Zimbra's own advisory table confirms the CVE and the 10.1.20 fix but gives no disclosure date and no score, so Microsoft's 13 August 2026 and the 26 June 2026 advisory date in Zimbra's release post are still not reconciled. The exploitation timeline is Microsoft's account, supported by CISA's listing of 21 August 2026. We will update this when it can be confirmed, and remove this note.

What happened

According to Microsoft:

• CVE-2026-73570 is an unauthenticated command injection. It can be reached only on servers that have the optional zimbra-snmp package installed with SNMP notifications enabled.
• Zimbra 10.1.20, released on 20 July 2026, contains the fix. Zimbra’s release post calls it the “permanent fix” for a vulnerability disclosed in its advisory of 26 June 2026; Microsoft dates the public disclosure of the CVE to 13 August 2026.
• Between 28 July and 7 August, after the fix shipped and before the CVE was published, Microsoft saw two scanning tools probing the vulnerable path, confirming that commands would run without yet delivering a payload.
• CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalogue on 21 August 2026, with a remediation due date of 24 August 2026 for US federal agencies.
• Exploitation followed, affecting organisations in more than one region and industry. Microsoft describes web shells and reverse shells, persistence as root, and mailbox archives being sent out to cloud storage.

The lesson is uncomfortable: a fix was available for weeks, and attackers appear to have studied it faster than many administrators applied it.

Who is affected

Organisations that run their own Zimbra mail servers, and hosting and service providers that run them for customers, where zimbra-snmp is installed and SNMP notifications are on, and the server was not updated to 10.1.20 before the probing began. Our earlier item on the Zimbra 10.1.21 release covers a different set of flaws.

What to do

• Check the version on every Zimbra server and update to 10.1.20 or later; take the current release if you are updating anyway.
• Check whether zimbra-snmp is installed and SNMP notifications are enabled. If you do not need them, disable them.
• Hunt for signs of compromise from late July onwards: unfamiliar files in web directories, unexpected outbound connections and shells, new root-level persistence, and large mailbox exports. Microsoft's post lists the indicators it found.
• If you find any, treat it as a breach of email data, rotate credentials, and follow your incident and notification process.
• If a provider hosts your Zimbra, ask in writing when it applied 10.1.20 and whether it has checked for these indicators.

Corrected on 2 October 2026: an earlier version said the flaw was not in CISA’s exploited-vulnerabilities catalogue, where it has been listed since 21 August 2026, and gave only Microsoft’s disclosure date.

Sources

• Microsoft Threat Intelligence: Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 - 30 September 2026
• SecurityWeek: Zimbra vulnerability exploited in the wild prior to public disclosure - 1 October 2026
• The Register: Microsoft catches hackers exploiting Zimbra bug before disclosure - 1 October 2026
• CISA Known Exploited Vulnerabilities catalogue: CVE-2026-73570, Synacor Zimbra Collaboration Suite (added 21 August 2026) - 21 August 2026
• Zimbra: Patch Release Update, Zimbra 10.1.20 - 20 July 2026
• Zimbra Security Advisories (read 2 October 2026) - 2 October 2026