Microsoft Warns of Active Exploitation Targeting Patched Zimbra Collaboration Suite Flaw

Threat actors have actively weaponized a now-patched security vulnerability in the Zimbra Collaboration Suite (ZCS) to deploy stealthy web shells, establish persistent access, and exfiltrate sensitive mailbox data from compromised enterprise mail servers, according to recent intelligence released by the Microsoft Security Research team.

The sophisticated campaign exploits an unauthenticated operating system command injection flaw tracked as CVE-2026-73570, which carries a critical CVSS severity score of 8.9. The vulnerability stems from how the collaboration platform handles Simple Network Management Protocol (SNMP) notifications. Specifically, the remote code execution flaw can be triggered when SNMP notifications are enabled and the optional "zimbra-snmp" package is installed on the target server.

Because the vulnerability requires no prior authentication or user interaction, attackers can successfully launch exploits by simply sending a specially crafted SMTP request—essentially an email—directly to exposed Zimbra servers. Recognizing the severity of the issue, Zimbra developers released version 10.1.20 in July 2026 to patch the vulnerability, closing the security gap before widespread damage could occur.

However, before the industry fully absorbed the update, malicious actors wasted no time in weaponizing the flaw. "Following successful exploitation, observed activity included deployment of JSP web shells and reverse shells, privilege escalation, persistent remote-access tooling, and memory-backed execution," Microsoft detailed in its advisory. "Threat actors also accessed email and collected authentication and mailbox data, with archive creation and subsequent transfer activity observed."

According to telemetry data gathered by Microsoft, the malicious activity affected organizations across multiple regions and diverse industries, highlighting the broad, indiscriminate nature of the targeting. Although various stages of the attack chain differed depending on the specific host environment, researchers noted that not every compromised server exhibited every single phase of the post-exploitation playbook. At present, the identity of the threat actors orchestrating these campaigns remains unknown to researchers and incident responders.

The active exploitation of CVE-2026-73570 first came to light in August 2026, when the Polish Computer Emergency Response Team (CERT Polska) published warnings about real-world attacks leveraging the SNMP flaw. At the time, the emergency response agency urged system administrators and security teams to rigorously review the "/var/log/zimbra.log" file for abnormal Zimbra service restarts, while simultaneously checking temporary directories and Zimbra "webapps" folders for unauthorized or suspicious files.

Shortly after CERT Polska raised the alarm, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its authoritative Known Exploited Vulnerabilities (KEV) catalog. This designation mandated that federal civilian executive branch agencies apply the necessary patches or mitigations by August 24, 2026, underscoring the critical national security implications of leaving enterprise mail servers exposed.

Microsoft’s telemetry indicates that the documented attack activity took place within a narrow and critical time window: between July 20, 2026, when Zimbra released version 10.1.20, and August 13, 2026, when details of the vulnerability were publicly disclosed. During the preliminary phases of this campaign, specifically between July 28 and August 7, 2026, researchers observed two distinct out-of-band scanning tools probing the injection path. These scanners were used strictly to validate whether command execution was possible on targeted servers without immediately delivering a heavier follow-on payload.

Once the attackers confirmed their ability to execute arbitrary commands, they leveraged this initial access vector to run commands directly under the privileges of the "zimbra" service account. To ensure high availability and redundancy for their access, the threat actors deployed multiple JSP web shells across Jetty and mailboxd application paths. Furthermore, they downloaded and executed malicious payloads directly onto the machines using standard administrative utilities like "wget" or "curl," ultimately establishing interactive reverse shells for manual control.

To evade detection and maintain long-term access, the intruders employed a variety of system-level persistence mechanisms. "Other execution chains used cron, systemd, or memfd_create to maintain recurring or memory-backed execution," Microsoft explained. "In some cases, attackers temporarily enabled write access to a public directory to deploy the web shell and then restored the directory permissions, limiting the visibility of the change during basic permission checks."

In at least one distinct campaign analyzed by security researchers, the attackers utilized a lightweight shell downloader designed to fetch a Go binary known as Zimdown2. This binary subsequently acted as an installer for a sophisticated remote-access agent called Zimclient2. Once installed, Zimclient2 provided the threat actors with interactive shell access, bidirectional file operations, and SOCKS5 proxy capabilities, turning the compromised mail server into a secure staging ground.

"It supported WebSocket, TLS, and raw TCP transports, providing resilient remote access and potential network pivoting through compromised Zimbra servers," Microsoft noted, detailing the flexibility of the remote-access tool. Evidence uncovered during the incident response process revealed several persistence mechanisms associated with this payload, including systemd services, OpenRC scripts, cron jobs, shell startup files, authorized SSH keys, and the unauthorized creation of local user accounts.

Beyond establishing persistent backdoors, the campaigns also involved the deployment of specialized, Zimbra-targeted payloads designed explicitly for data harvesting. Researchers identified a Go-based executable that systematically attempted to extract Zimbra service-account credentials from the "/opt/zimbra/conf/localconfig.xml" configuration file. Armed with these administrative credentials, the executable constructed database connection strings to interact with the local MySQL and LDAP instances, allowing the attackers to export the contents of critical database tables.

The malicious implant also functioned as a comprehensive collection tool, gathering credentials, security certificates, LDAP secrets, mail rules, and various system configuration artifacts. Once harvested, these sensitive files were compressed into a single ZIP archive to prepare them for exfiltration to an external, attacker-controlled endpoint.

In a particularly striking instance observed on a compromised server, the actors gathered recent mailbox-backup content and archived it into "/opt/zimbra/final.tar.gz." Following this staging phase, the attackers downloaded AzCopy—a legitimate command-line utility used for copying data to and from Azure storage—from a Microsoft URL. They then invoked the utility using an operator-supplied Azure Blob Storage Shared Access Signature (SAS) URL pointing toward an external storage account.

"This activity shows mailbox-data collection, local archive staging, and an exfiltration attempt using cloud-storage tooling; available evidence does not confirm that the transfer completed successfully," Microsoft added, emphasizing that while the staging and tool deployment steps were clearly executed, final data theft could not be fully verified in every instance.

To mitigate these severe risks and protect enterprise networks from ongoing exploitation attempts, security professionals strongly advise organizations to apply the official software updates immediately. For administrators who find themselves unable to patch their systems right away, recommended interim mitigations include completely uninstalling the "zimbra-snmp" package, disabling SNMP notifications, and strictly limiting network access to SNMP and SMTP services to trusted hosts only. Additionally, organizations are urged to rotate all Zimbra authentication secrets and conduct thorough forensic scans of their servers to detect and remove any lingering web shells or unauthorized persistence mechanisms.