Zimbra mail server vulnerability exploited: check for signs of compromise after updating
Microsoft reviews observed exploitation of Zimbra CVE-2026-73570, urging administrators to address patches, account credentials and server investigation together.
Source Facts
Research published on 30 September says internet-facing Zimbra servers with the optional zimbra-snmp package installed and SNMP notifications enabled may be attacked without authentication or user interaction. The fix was included in version 10.1.20, released on 20 July.
Microsoft observed persistent-access tools and collection of email and authentication data during its investigation. Some transfers remain unconfirmed and must not all be described as successful exfiltration. Exposed systems need backdoor investigations as well as updates.
Patching can address the vulnerability, but a previously compromised server still needs separate investigation and recovery.
Original sources
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationAmazon Linux updates its Docker security advisory: check container hosts and archive handling
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
Illustration