[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3DIkiyhZE1LoD7QQZui7XbqTugRvPKCFTkrDtPWrzVY":3},{"article":4,"iocs":48,"watch_terms":66,"solutions":67,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"844742f5-d02f-401b-ae75-dc6b59082741","Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570","unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2-ed9384","Microsoft Threat Intelligence examines CVE-2026-73570 exploitation in Zimbra, including observed attack paths, detection opportunities, and mitigation guidance. The post Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 appeared first on Microsoft Security Blog.","Microsoft Threat Intelligence has identified exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite. Attackers can exploit this by sending a specially crafted email to internet-facing Zimbra servers with the zimbra-snmp package installed and SNMP notifications enabled. Exploitation leads to the deployment of web shells, privilege escalation, and access to email and authentication data.","CVE-2026-73570: Unauthenticated command injection in Zimbra mail servers exploited.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F30\u002Funauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002FMS_Actional-Insights_Detection-hunting_social.webp","2026-09-30T14:00:00+00:00","2026-09-30T16:00:16.003785+00:00",9,[17,20,22],{"name":18,"type":19},"Zimbra Collaboration Suite","product",{"name":21,"type":19},"zimbra-snmp",{"name":23,"type":24},"Microsoft","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,57,59,61,63],{"type":50,"value":51,"context":52},"cve","CVE-2026-73570","Unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite SNMP notification path.",{"type":54,"value":55,"context":56},"domain","oast[.]fun","Collaborator service used for out-of-band command execution validation.",{"type":54,"value":58,"context":56},"oast[.]online",{"type":54,"value":60,"context":56},"dnslog[.]pp[.]ua",{"type":54,"value":62,"context":56},"requestrepo[.]com",{"type":54,"value":64,"context":65},"bypass[.]eu[.]org","Campaign-associated infrastructure for out-of-band command execution validation.",[23,18,21],{"controls":68,"vendors":151},[69,98,122],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,107,114],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":99,"product_name":104,"url":105,"description":106},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":108,"vendor_name":23,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":123,"name":124,"problem":125,"products":126},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",[152],{"slug":108,"name":23,"logo_path":109,"roles":153},[154],"reported_by",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":174},"unauthenticated-command-injection-in-zimbra-mail-servers-enables-web-shell-deployment","Unauthenticated Command Injection in Zimbra Mail Servers Enables Web Shell Deployment","CVE-2026-73570 exposes a critical unauthenticated OS command injection flaw in Zimbra Collaboration Suite, exploitable simply by sending a crafted email to internet-facing servers running the zimbra-snmp package with SNMP notifications enabled. The attack requires no credentials, dramatically lowering the barrier for threat actors and making internet-exposed mail servers an immediate high-value target. Successful exploitation grants attackers persistent access via web shells, the ability to escalate privileges, and direct access to sensitive email and authentication data. This incident highlights how non-essential features (SNMP notifications) left enabled on critical infrastructure dramatically expand the attack surface. Organizations that fail to promptly patch or disable vulnerable components on internet-facing systems risk full compromise of their communication and identity infrastructure.",[160,161,162,163,164,165,166,167,168,169,170,171,172,173],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-3: Malicious Code Protection","NIST CSF ID.RA-1: Asset Vulnerabilities are Identified and Documented","NIST CSF PR.IP-12: Vulnerability Management Plan","GDPR Article 32: Security of Processing (appropriate technical measures)","ITIL: Change Enablement – emergency change procedures for critical patches","OWASP: OS Command Injection Prevention",{}]