Attackers have been exploiting critical Zimbra flaw to steal emails

Microsoft and others reported active exploitation of CVE-2026-73570 in Zimbra Collaboration Suite, an unauthenticated command-injection flaw in the SNMP notification path (when zimbra-snmp is enabled). Attackers scanned for vulnerable servers, validated exploits, and deployed JSP web shells, reverse shells, privilege-escalation tools, and remote-access/backdoor tooling, then accessed and exfiltrated mailboxes and authentication data; Shadowserver found hundreds of compromised instances while roughly 10,000 Zimbra servers remain exposed.