Zimbra CVE-2026-73570 Exploited: Web Shells and Credential Theft

Thu, 01 Oct 2026 17:21:52 +0000

Engineer — Act: CISA KEV-listed, public PoC active, CVSS 8.9 unauthenticated RCE via SNMP path — patch Zimbra Collaboration Suite to the vendor-released fixed version immediately and audit Zimbra webroot directories for newly created or modified web shell files.
SOC/IR — Act: Active exploitation confirmed with web shell staging and authentication secret harvesting; hunt for unexpected child processes spawned from the Zimbra service account since late September and sweep Zimbra webroot paths for recently written .jsp/.php files indicative of web shell deployment.
Leader — Act: CISA KEV listing for an unauthenticated RCE in a widely-deployed enterprise mail platform with confirmed credential harvesting — confirm whether Zimbra is in your environment, verify patching status with the infrastructure team, and assess whether harvested mailbox credentials could expose sensitive communications or escalate to broader account compromise.
Signals: CVE-2026-73570 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub, reported by 2 collected sources

Cve-Exploitation on CuraSec