[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f97PuOrUGtUnQdgkKTQMRUGPxCSv1JWi71cWz6xe_0G8":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"c2516716-c271-48aa-a95c-083c910a360d","Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure","zimbra-vulnerability-exploited-in-the-wild-prior-to-public-disclosure-bb1cb4","Under certain conditions, CVE-2026-73570 can be exploited via specially crafted emails without user interaction. The post Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure appeared first on SecurityWeek.","Hackers exploited a critical OS command injection vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite before it was publicly disclosed. Exploitation occurred between the patching date and public disclosure, allowing attackers to achieve remote code execution and deploy webshells. Microsoft observed scanning tools probing the vulnerability, followed by exploitation that led to credential exfiltration and the deployment of a remote access agent.","Zimbra vulnerability CVE-2026-73570 exploited in the wild before public disclosure.","https:\u002F\u002Fwww.securityweek.com\u002Fzimbra-vulnerability-exploited-in-the-wild-prior-to-public-disclosure\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002Fenterprise-collaboration-Zimbra.jpeg","2026-10-01T12:55:57+00:00","2026-10-01T14:00:29.899702+00:00",9,[17,20,23],{"name":18,"type":19},"Zimbra Collaboration Suite","product",{"name":21,"type":22},"Zimbra","vendor",{"name":24,"type":22},"Microsoft","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":51,"context":52},"cve","CVE-2026-73570","OS command injection vulnerability in Zimbra Collaboration Suite",[24,21,18],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[144],{"slug":145,"name":24,"logo_path":146,"roles":147},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":166},"zimbra-zero-day-exploited-before-public-disclosure-patch-window-is-not-a-safe-window","Zimbra Zero-Day Exploited Before Public Disclosure — Patch Window Is Not a Safe Window","Attackers exploited a critical OS command injection flaw in Zimbra Collaboration Suite during the gap between when a patch was issued and when the vulnerability was publicly announced — a period organizations often treat as low-risk. This 'silent patch' exploitation technique means threat actors are actively reverse-engineering vendor updates to identify and weaponize vulnerabilities before defenders are even aware of the risk. The consequences were severe: remote code execution, webshell deployment, credential theft, and persistent access via a remote access agent. This incident demonstrates that patching must begin immediately upon release — not after public CVE disclosure — and that internet-facing collaboration platforms require continuous monitoring for anomalous behavior.",[154,155,156,157,158,159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST SI-3: Malicious Code Protection","NIST IR-5: Incident Monitoring","NIST CA-7: Continuous Monitoring","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1505.003: Server Software Component — Web Shell","ITIL Change Management: Emergency Change Procedures","ISO\u002FIEC 27001 Annex A 12.6: Management of Technical Vulnerabilities",{"NIST SI-2: Flaw Remediation":167,"NIST IR-5: Incident Monitoring":168,"NIST CA-7: Continuous Monitoring":169,"NIST SI-3: Malicious Code Protection":170,"CIS Control 13: Network Monitoring and Defense":171,"CIS Control 12: Network Infrastructure Management":172,"CIS Control 7: Continuous Vulnerability Management":173,"ITIL Change Management: Emergency Change Procedures":174,"MITRE ATT&CK T1190: Exploit Public-Facing Application":175,"MITRE ATT&CK T1505.003: Server Software Component — Web Shell":176,"ISO\u002FIEC 27001 Annex A 12.6: Management of Technical Vulnerabilities":177,"NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning":178},"Requires timely remediation, and silent patches still need to be applied quickly.","Monitoring for incidents helps spot exploitation that occurred before the flaw was disclosed.","Continuous monitoring keeps watch on Zimbra servers for suspicious activity during the patch gap.","Malicious code protection can detect web shells dropped after the Zimbra command injection.","Network monitoring can detect exploitation of the command injection before disclosure is public.","Limiting exposure of Zimbra servers reduces the attack surface while patches are being applied.","Treating the period after a silent patch as urgent means applying Zimbra updates immediately, not waiting for public disclosure.","Emergency change procedures let teams deploy security patches as soon as vendors release them.","Describes exploitation of internet-facing applications like Zimbra.","Covers web shells, which attackers often install after exploiting mail server flaws like this one.","Requires timely action on technical vulnerabilities, including patches released without detailed advisories.","Patch planning should treat every vendor security update as urgent, since attackers reverse-engineer patches."]