Microsoft has warned that hackers are actively exploiting a critical vulnerability in the Zimbra Collaboration Suite to steal email backups and authentication credentials from vulnerable organizations. The flaw, identified as CVE-2026-73570, allows attackers to remotely issue operating system commands without requiring any form of authentication.
Synacor, the maintainer of Zimbra, released a patch for the issue on July 20. However, the company did not disclose the vulnerability to the public until more than three weeks after the patch was available. Following the disclosure, the Shadowserver Foundation reported last week that its network scans identified 274 separate instances of the Zimbra Collaboration Suite that had already been compromised.
The total number of servers running the software has declined since the patch was released. In the week following the July 20 update, approximately 19,000 instances were detected. That number dropped to about 12,000 in the subsequent weeks, and Shadowserver is currently tracking around 10,000 instances.
Microsoft stated that from July 28 to August 7, it detected two distinct scanning tools probing the internet for vulnerable endpoints. During this period, attackers validated their exploit by sending HTTP requests and DNS, ICMP, and out-of-band identity checks to domains hosted on public services. These probes allowed the attackers to confirm that their commands executed successfully on vulnerable servers without fully compromising them. Once validation was complete, the attackers began using the command injection capability to install malicious payloads.