News › security
By The Linux Camp News, October 1, 2026
CVE-2026-73570 exposes Zimbra installations with an optional SNMP package and notifications enabled. Microsoft reported server compromises and mailbox-data collection, but successful exfiltration was not verified.
Microsoft published an exploitation report on September 30, 2026, covering CVE-2026-73570 in Zimbra Collaboration Suite. According to Ars Technica’s account of Microsoft’s findings, attackers used the unauthenticated command-injection flaw to compromise mail servers, access email and collect authentication and mailbox data. This is reported exploitation, not just a research demonstration, although successful data exfiltration was not verified. 3 1
The entry point is a crafted SMTP request, but the vulnerable processing happens in the SNMP notification path. Improper sanitization lets attacker-controlled input become operating-system commands: that transition from data to executable instructions is command injection. The official CVE record says those commands run as the Zimbra user, not automatically as root. It identifies two necessary configuration conditions: the optional zimbra-snmp package must be installed and SNMP notifications must be enabled. 4
Ars reports that Synacor issued a patch on July 20, more than three weeks before disclosing the vulnerability. Microsoft’s reported scanning window was July 28 through August 7, when it detected two tools probing for vulnerable endpoints. Those dates describe observed scanning, not the first successful compromise or the vulnerability’s discovery date. 1 2
The reported activity progressed beyond probes. Microsoft described deployment of web shells and reverse shells, privilege escalation and persistent remote-access tooling, followed by mailbox-data collection and archive transfer activity. The operational implication is that an exposed server may require a compromise investigation as well as vulnerability remediation: checking its version alone would not establish whether attackers had already gained persistent access. 1
The official records retrieved October 1 distinguish severity from exploitation status. The CVE record assigns CVSS 3.1 a score of 8.9, rated High, rather than the “critical” label used by Ars. Separately, CISA’s Known Exploited Vulnerabilities catalog lists the flaw with an August 21 addition date. The score describes severity; the catalog entry records its known-exploited status. 4 5 1
Start by checking the running Zimbra release, whether zimbra-snmp is installed and whether notifications are enabled. This maps the installation to the documented prerequisites rather than treating every Zimbra server as equally exposed. As retrieved October 1, the official CVE record identifies releases before 10.1.20 as affected under those conditions; Ars advises running 10.1.20 or later. Verify the running release, not merely that an updated package has been installed. For an exposed system, use vendor mitigation instructions and investigate the reported persistence behaviors alongside patch verification. 4 1 5
The supplied Microsoft material contains a heading and research summary, so the detailed attack account here relies on Ars’s reporting of Microsoft, not independent confirmation from multiple investigations. Microsoft could not verify successful exfiltration, and the account does not identify the attackers or their motivations. Collection and transfer activity therefore should not be presented as conclusive proof that mailbox data reached an attacker. 3 1