Hackers Exploit Zimbra Flaw Before Public Disclosure

Microsoft's threat intelligence team has identified hackers exploiting a critical vulnerability in Zimbra mail servers before it was publicly disclosed. The flaw, CVE-2026-73570, allows attackers to send specially crafted emails that can run commands on vulnerable systems without the need for stolen passwords or social engineering.

The researchers tracked the exploitation of this vulnerability from July 28 to August 7, more than two weeks before it was publicly disclosed on August 13. During this time, the attackers used a collection of common network utilities to test the flaw and find vulnerable systems.

Once they found a foothold, the attackers deployed web shells and reverse shells, escalated their privileges, installed tools for persistent remote access, and ran malicious code directly in memory. In some cases, they even temporarily changed permissions on public directories to plant web shells and then restored the original settings afterward.