Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Summary

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team. The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.