Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite to deploy web shells and access mailbox data, according to Microsoft Security Research. The attack exploits CVE-2026-73570, an unauthenticated operating system command injection flaw with a CVSS score of 8.9, which can lead to remote code execution when Simple Network Management Protocol is used.