Zimbra Vulnerability Exploited for Web Shell Deployment and Credential Harvesting

Threat actors exploited a patched Zimbra vulnerability (CVE-2026-73570) to deploy web shells, harvest authentication secrets, and exfiltrate mailbox data. The attack involved command injection, privilege escalation, and persistence mechanisms through systemd, cron, and memory-backed execution.

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team.

The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol

Read original article