🚨Zimbra Bug Exploited Weeks Before Disclosure
Hackers hit Zimbra servers before the fix was even out
TL;DR
Hackers exploited a Zimbra bug weeks before its public disclosure, highlighting the dangers of delayed patching. The flaw, CVE-2026-73570, affects servers running SNMP monitoring with notifications enabled. Microsoft spotted scanning tools probing the flaw from July 28 to August 7.
Hackers exploited a Zimbra bug weeks before its public disclosure, giving them a backdoor into exposed mail servers. The flaw, CVE-2026-73570, is an unauthenticated command injection vulnerability that allows attackers to send specially crafted emails to vulnerable servers and run commands without needing stolen credentials. Zimbra fixed the flaw in version 10.1.20 on July 20, but the attackers were already in. Microsoft spotted scanning tools probing the flaw from July 28 to August 7, indicating early exploitation. If you're running Zimbra with SNMP notifications enabled, update to 10.1.20 or disable SNMP notifications to stay safe.
Key Points
CVE-2026-73570 affects Zimbra servers running SNMP monitoring with notifications enabled.
Zimbra fixed the flaw in version 10.1.20 on July 20, 2023.
Microsoft spotted scanning tools probing the flaw from July 28 to August 7, 2023.
The attackers used common network utilities to make vulnerable systems call back to infrastructure they controlled.
Some attackers temporarily changed permissions on public directories to plant web shells and restore settings afterward.
Why It Matters
If you're running Zimbra with SNMP notifications enabled, update to 10.1.20 or disable SNMP notifications to stay safe. The attackers exploited a critical vulnerability weeks before public disclosure, highlighting the importance of timely patching and monitoring.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,556 builders reading daily.