Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

Microsoft Threat Intelligence identifies active, in-the-wild exploitation of CVE-2026-73570 — an unauthenticated command-injection vulnerability in Zimbra's SNMP notification path — which allowed attackers to execute commands as the zimbra service account, deploy JSP web shells and remote-access agents, escalate to root, and stage or attempt exfiltration of mailbox and authentication material; the report includes detailed attack-chain analysis, IOCs (IPs, domains, SHA-256 hashes), MITRE ATT&CK mappings, advanced hunting queries, and mitigations including patching to Zimbra 10.1.20.