🟠High: Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
-
Threat actors are actively exploiting a now-patched vulnerability in Zimbra Collaboration Suite (ZCS) to plant web shells and steal mailbox data, according to research from the Microsoft Security Research team. The flaw, tracked as CVE-2026-73570, carries a CVSS score of 8.9 and is described as an unauthenticated operating system command injection issue that can lead to remote code execution.
The attack chain begins with the unauthenticated command injection, which allows adversaries to run arbitrary commands on exposed Zimbra instances. Once inside, attackers deploy web shells to maintain persistent access and go after authentication secrets and mailbox content.
Key details to note:
- Affected platform: Zimbra Collaboration Suite (ZCS)
- Vulnerability type: unauthenticated OS command injection leading to remote code execution
- Identifier: CVE-2026-73570
- Severity: CVSS 8.9
- Status: patch is available; the flaw is now patched
- Observed post-exploitation activity: web shell deployment and mailbox data access
If your organization runs Zimbra, confirm you are on a patched build and review your mail infrastructure for signs of unauthorized access, including unexpected web shells and suspicious authentication activity. Because the flaw is unauthenticated, any internet-facing ZCS instance that has not been updated should be treated as potentially exposed.
Source: The Hacker News
Has your organization already applied the Zimbra patch, and what steps are you taking to check for web shells or compromised credentials?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login