Skip to content
securitytabs

LiveUpdated

Zimbra Collaboration Suite flaw CVE-2026-73570 exploited to steal email data

A serious flaw in Zimbra, email and collaboration software that organizations host themselves, is being used by attackers to take over mail servers and steal email backups and passwords. Organizations running Zimbra should check that they have applied the fix.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small organizations that use Zimbra, often through a hosting provider, face attacks aimed at stealing email backups and passwords. [1]

What to do

  1. Ask your email or hosting provider whether Zimbra is used and whether the vendor's security fix for this flaw has been applied. [2]
  2. Do not rely on a public test script to confirm you are patched, since Elastic says some give misleading results. [3]

Mid-size company

A small IT or security team

What to know

The flaw is in CISA's KEV catalogue and Microsoft has published detection and mitigation guidance for internet-facing Zimbra servers. [2]

What to do

  1. Identify internet-facing Zimbra servers and apply Zimbra's security updates. [2]
  2. Follow the detection and mitigation guidance in Microsoft's post and review whether email backups or credentials could have been accessed. [2][1]

Large enterprise

A security operations team

What to know

Microsoft reports attack paths aimed at email backups and credentials, and Elastic warns that failed proof-of-concept tests can wrongly suggest a server is patched. [1][3]

What to do

  1. Patch all Zimbra servers per the vendor's advisories and confirm patch status from versions rather than from public exploit scripts. [3]
  2. Apply the detection opportunities in Microsoft's post and hunt for access to mail backups and credential theft on Zimbra hosts. [2][1]

Vulnerabilities

What happened

Microsoft Threat Intelligence published an analysis on September 30, 2026 of exploitation of CVE-2026-73570, an operating system command injection flaw in Zimbra Collaboration Suite. Ars Technica reports the flaw lets attackers remotely issue operating system commands without authentication. [2][1]

NVD rates the flaw 8.9 on the CVSS v3.1 scale. CISA lists it in its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, since August 21, 2026, with a federal due date of August 24, 2026. Whether ransomware groups use it is listed as unknown. [2]

Exploitation

Ars Technica, citing Microsoft's warning, reports that attackers have been exploiting the flaw to try to obtain email backups and authentication credentials from vulnerable organizations. Microsoft's post covers observed attack paths, detection opportunities and mitigation guidance. [1][2]

On October 23, 2026 Elastic Security Labs said it reproduced the flaw and found that several public proof-of-concept exploits write a payload that the vulnerable Zimbra component never matches, so a failed test can make an unpatched server look patched. Elastic explains how a Zimbra log file leads to remote code execution. [3]

Patches and mitigations

Zimbra's security advisories and a notice from CERT Polska are referenced in the CVE record. The articles available to us do not list fixed version numbers, so administrators should consult Zimbra's advisories directly. [2][3]

Timeline

  1. Elastic Security Labs published its reproduction of the flaw and warned that some public proof-of-concept tests can falsely suggest a server is patched. [3]

  2. Ars Technica reported attackers were exploiting the flaw to steal email backups and credentials. [1]

  3. Microsoft Threat Intelligence published its analysis of CVE-2026-73570 exploitation. [2]

  4. · CISA KEV

    CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog.

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Sources

  1. [1]Ars Technica Security · Sep 30, 20:44 UTC
    Attackers have been exploiting critical Zimbra flaw to steal emailscontext
  2. [2]Microsoft Security Blog · Sep 30, 14:00 UTC
    Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570context
  3. [3]Elastic Security Labs · Oct 23, 00:00 UTC
    How CVE-2026-73570 turns a Zimbra log file into remote code executioncontext