We handle all your technical problems so you can focus on growing your business.
A row of brightly colored, numbered roadside mailboxes on a post.
CybersecurityPractical insight for your business.

Microsoft Details Break-Ins at Zimbra Mail Servers Through a Flaw Fixed in July

Microsoft says attackers used a Zimbra flaw to plant web shells and collect mailbox data with a single crafted email. Updating closes the hole, but servers exposed before the update need to be checked.

Kevin R.

3 min read

Photo by Philippe Murray-Pietsch on Unsplash

The takeaway

If your email runs on Zimbra, confirm in writing that the server is on version 10.1.20 or later. If it was exposed before that, have it checked for web shells and rotate its authentication keys.

On Wednesday, September 30, 2026, Microsoft Threat Intelligence published an analysis of attacks on Zimbra Collaboration Suite, an email and calendar server that some organizations run themselves or get through a hosting company. The flaw, tracked as CVE-2026-73570, lets an attacker run commands on the server by sending a specially crafted email, with no password and no action by anyone at the business.

The fix isn’t new. What’s new is Microsoft’s account of what attackers did after they got in.

What happened

According to Microsoft:

  • The flaw works only when the optional zimbra-snmp package is installed and SNMP notifications are turned on. (SNMP is a protocol used to monitor a server’s health.)
  • Zimbra fixed it in version 10.1.20, released Monday, July 20, 2026 (Zimbra). The flaw was publicly disclosed on August 13.
  • Microsoft saw scanning tools probing the vulnerable spot between July 28 and August 7, after the fix was available but before the flaw was public.
  • After breaking in, attackers planted web shells (small files that let them send commands to the server later through a web browser), escalated their privileges, installed remote-access tools, and “collected authentication and mailbox data.”

CISA added the flaw to its Known Exploited Vulnerabilities catalog on Friday, August 21, 2026. Microsoft says it saw affected organizations in more than one region and industry.

Who is affected

Only businesses whose email runs on Zimbra. Mail hosted on Microsoft 365 or Google Workspace runs on different software and isn’t affected by this flaw. If you don’t know what your email runs on, ask your email provider or IT provider.

What to do

1. Confirm the version. The server should be on Zimbra 10.1.20 or later. If a hosting company runs it, ask them to confirm that in writing.

2. If the server was exposed before it was updated, have it checked. An update closes the hole but doesn’t remove anything an attacker already planted. Microsoft’s guidance for whoever manages the server includes:

  • Checking every mailbox server for unexpected JSP files (the type of web shell Microsoft observed) and unfamiliar system services.
  • Rotating all of the server’s zimbraPreAuthKey values, which are authentication keys Microsoft says attackers retrieved.

Microsoft warns: “Do not assume that removing one known JSP eliminates access.”

3. If the update has to wait, Microsoft says to uninstall the zimbra-snmp package, turn off SNMP notifications, and limit SNMP and mail (SMTP) access to trusted systems.

If you’re not sure what runs your email or who maintains it, NightSquawk Tech offers a free assessment.

Sources

Editorial note: This article was drafted with AI assistance from Microsoft’s threat intelligence report, Zimbra’s release notes, the National Vulnerability Database and CISA’s catalog, linked above. NightSquawk Tech did not test this vulnerability or observe the attacks described. Version numbers are as published on October 9, 2026.