Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
CVE-2026-73570: Unauthenticated command injection in Zimbra mail servers exploited.
Microsoft Threat Intelligence has identified exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite. Attackers can exploit this by sending a specially crafted email to internet-facing Zimbra servers with the zimbra-snmp package installed and SNMP notifications enabled. Exploitation leads to the deployment of web shells, privilege escalation, and access to email and authentication data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-73570 exposes a critical unauthenticated OS command injection flaw in Zimbra Collaboration Suite, exploitable simply by sending a crafted email to internet-facing servers running the zimbra-snmp package with SNMP notifications enabled. The attack requires no credentials, dramatically lowering the barrier for threat actors and making internet-exposed mail servers an immediate high-value target. Successful exploitation grants attackers persistent access via web shells, the ability to escalate privileges, and direct access to sensitive email and authentication data. This incident highlights how non-essential features (SNMP notifications) left enabled on critical infrastructure dramatically expand the attack surface. Organizations that fail to promptly patch or disable vulnerable components on internet-facing systems risk full compromise of their communication and identity infrastructure.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-73570
- domain — oast[.]fun
- domain — oast[.]online
- domain — dnslog[.]pp[.]ua
- domain — requestrepo[.]com
- domain — bypass[.]eu[.]org