Microsoft catches hackers exploiting Zimbra bug before disclosure
ID: eca59e84-01c6-5a74-98af-8f6b5862d398
STIX ID: report--eca59e84-01c6-5a74-98af-8f6b5862d398
Feed Name: The Register (Security)
Threat Score
Microsoft observed attackers exploiting CVE-2026-73570 — an unauthenticated command-injection flaw in Zimbra's optional SNMP monitoring package — to probe internet-facing mail servers, deploy web/reverse shells, escalate privileges (including to root), harvest service and mailbox credentials, and attempt mailbox backup exfiltration (including use of AzCopy); Zimbra released a fix in 10.1.20 and mitigations include removing the SNMP package or disabling SNMP notifications.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.