Cybersecurity
Attackers used Zimbra flaw to steal mailbox data
Microsoft said attackers exploited a patched Zimbra Collaboration Suite flaw to run shells, collect mailbox and authentication data, and attempt exfiltration, while CERT Polska and CISA later issued warnings and deadlines.
- Microsoft said it had observed exploitation of CVE-2026-73570 in Zimbra Collaboration Suite after Zimbra released version 10.1.20 in July 2026.
- The flaw could be reached with a crafted SMTP request when SNMP notifications were enabled and the optional zimbra-snmp package was installed.
- Microsoft said attackers deployed web shells, reverse shells, privilege escalation and persistence tools, and accessed email, authentication data and mailbox data.
- CERT Polska had already flagged active exploitation in August 2026, and CISA later added the issue to its Known Exploited Vulnerabilities catalogue with a 24 August 2026 deadline for federal fixes.
- Microsoft said one campaign used Zimdown2 to install Zimclient2, and one compromised server was used in an AzCopy-based exfiltration attempt that was not confirmed to have completed.
Microsoft Security Research said it had observed exploitation of CVE-2026-73570 in Zimbra Collaboration Suite after Zimbra shipped version 10.1.20 in July 2026. It said the flaw could be reached with a crafted SMTP request when SNMP notifications were enabled and the optional zimbra-snmp package was installed.
Microsoft placed the activity between 20 July and 13 August 2026. It said it saw two scanning tools between 28 July and 7 August checking whether command execution was possible, before attackers moved to JSP web shells, reverse shells, privilege escalation and memory-backed execution.
The company said the operators used the zimbra account to map deployments, changed sudo settings to give that account passwordless elevated access, created a systemd service called zimlog.service, and reused the server's SSH identity for movement between trusted nodes. Microsoft also said one campaign used Zimdown2 to install Zimclient2, which provided shell access, file transfer and SOCKS5 proxying.
Microsoft said another payload read localconfig.xml, built MySQL and LDAP connections, and exported tables such as mailbox and mailbox_metadata together with other Zimbra database content and files. In one case it said the actor archived recent mailbox-backup content to /opt/zimbra/final.tar.gz and then used AzCopy with an Azure Blob SAS URL to try to send it to a Windows Blob endpoint, but it did not confirm that the transfer succeeded.
CERT Polska had earlier flagged active exploitation in August 2026 and told administrators to inspect /var/log/zimbra.log and temporary and webapps directories. CISA later added the flaw to its Known Exploited Vulnerabilities catalogue and set 24 August 2026 as the fix deadline for federal agencies.
Named in this story
Companies
- Microsoft
- said its Security Research team observed the attacks
Organisations
- CERT Polska
- first highlighted active exploitation and advised log checks
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- added the flaw to the KEV catalogue and set the federal deadline
Products and systems
- Zimbra Collaboration Suite (ZCS)
- the affected email platform with the patched flaw
- zimbra-snmp package
- the optional package whose installation helped enable exploitation
- Zimdown2
- a Go downloader that installed Zimclient2
- Zimclient2
- a remote-access agent that provided shell and file operations
- AzCopy
- the cloud transfer tool used in the exfiltration attempt
How the source tells it
The article was a technical incident report with a restrained but urgent advisory register.
- urgency deadline-driven remediation advice and immediate-update language at the close
- threat emphasis loaded attacker-centric wording around weaponisation and exploitation in the lead