Threats tagged 'mail-server'

CVE-2026-73570 is an unauthenticated OS command injection vulnerability in the SNMP notification path of Zimbra Collaboration Suite mail servers. It was actively exploited between July and August 2026. Attackers used this flaw to deploy JSP webshells and reverse shells without authentication, escalate privileges via PAM configuration abuse, and maintain persistence through systemd services. Post-exploitation activities included lateral movement across clusters using Zimbra SSH keys, theft of authentication secrets and mailbox data, and attempts to exfiltrate data using cloud storage tools. Multiple organizations across various regions and industries were targeted through automated and manual attacks on internet-facing Zimbra mail servers.