Zimbra CVE-2026-73570 Was Exploited Before Disclosure

Attackers exploited Zimbra CVE-2026-73570 before the flaw was publicly disclosed, turning an unauthenticated command-injection bug into mailbox and credential theft. The incident shows that a patch can be available while defenders still lack the disclosure and detection context needed to prioritize it. Microsoft observed probing weeks before the CVE was assigned, while attacks deployed web shells and accessed mail data.

• CVE-2026-73570 is an unauthenticated operating-system command-injection flaw in Zimbra Collaboration Suite with a CVSS score of 8.9; exploitation can lead to remote code execution.
• Synacor issued a patch on July 20, 2026, but did not disclose the vulnerability for more than three weeks afterward.
• Observed attackers used the flaw to deploy web shells, access mailbox data, and seek authentication credentials from vulnerable organizations.
• Attackers were probing the Zimbra mail-server flaw weeks before it had a CVE identifier or was disclosed publicly.

Bottom line If you run Zimbra Collaboration Suite, verify the July 20 patch is deployed now and investigate for web shells, mailbox access, and exposed authentication credentials.