Zimbra Servers Are Being Hacked in a New Wave of CVE-2026-73570 Attacks
- The Mess: Attackers are actively exploiting CVE-2026-73570, a critical vulnerability in Zimbra Collaboration Suite, with researchers reporting hundreds of Internet-facing servers already compromised. The campaign is particularly concerning because Zimbra is widely deployed as a self-hosted email and collaboration platform, making a vulnerable server an attractive target for credential theft, persistence and lateral movement.
This is exactly the type of vulnerability that tends to disappear from the headlines until administrators suddenly discover that their mail server is no longer theirs.
Zimbra is not simply a web application.
It can contain:
email.
attachments.
contacts.
calendar data.
authentication information.
corporate communications.
And in many environments, compromising the mail server gives an attacker something even more valuable:
access to the organization’s identity ecosystem.
Hundreds of Servers Have Already Been Compromised
Security researchers tracking the campaign identified at least 274 Zimbra servers that had already been compromised.
Thousands more Internet-facing installations remained potentially vulnerable.
That’s the worrying part.
The attackers aren’t scanning an obscure piece of software used by a handful of companies.
They’re targeting a platform exposed directly to the Internet because email servers have to be reachable.
And that makes the attack surface particularly attractive.
A firewall can’t simply block Internet access to the mail server.
The server has a job to do.
It needs to communicate with the outside world.
That means vulnerability management becomes critical.
CVE-2026-73570 Is the Entry Point
The vulnerability tracked as CVE-2026-73570 affects Zimbra Collaboration Suite.
The flaw can be exploited remotely under certain conditions and has been used as part of the current attack wave.
Researchers observed attackers targeting exposed Zimbra installations and subsequently establishing control over compromised servers.
This is another important distinction.
The danger isn’t simply:
“Someone can crash Zimbra.”
The real concern is:
“A vulnerable Internet-facing mail server can become an attacker-controlled system.”
Once that happens, the consequences can extend well beyond email.
Why Email Servers Are Such Valuable Targets
Think about what your mail server sees every day.
Password-reset links.
MFA notifications.
Invoices.
Contracts.
Internal documents.
VPN information.
Cloud-service notifications.
Employee conversations.
Administrator communications.
Security alerts.
A compromised mailbox can therefore become a reconnaissance goldmine.
The attacker doesn’t necessarily need to immediately steal credentials.
They can simply watch.
Then wait.
Eventually someone sends:
“Here’s the VPN password.”
Or:
“The admin account is…”
Or:
“Use this link to reset…”
The mail system becomes a surveillance platform.
That’s why email compromises can remain hidden for a surprisingly long time.
The Attackers Don’t Need to Break the Password
This is another reason vulnerabilities in Internet-facing applications are dangerous.
An attacker exploiting a server-side vulnerability can potentially bypass the normal authentication workflow altogether.
Instead of:
username → password → MFA → mailbox
the attacker tries:
Internet → vulnerable service → code execution/access
That is why a strong password policy doesn’t compensate for an unpatched Internet-facing server.
Your password can be perfect.
Your MFA can be enabled.
Your users can be trained.
And the attacker can still attack the application itself.
The Numbers Should Worry Administrators
Researchers reported approximately:
274 confirmed compromised servers
and around:
8,200 potentially exposed installations
during the campaign.
That means the gap between:
“servers that may be vulnerable”
and
“servers that are already compromised”
is already measurable.
And attackers don’t need every vulnerable installation.
Even a few hundred compromised mail servers can provide a significant amount of valuable data.
Patch — Then Investigate
If you’re running Zimbra, the obvious first step is to install the vendor’s security update containing the fix for CVE-2026-73570.
But if your server was Internet-facing while vulnerable, don’t stop after the update.
That’s one of the most common mistakes in incident response.
An attacker may have already:
- created an account;
- installed persistence;
- modified configuration;
- added SSH keys;
- created scheduled tasks;
- dropped web shells;
- stolen credentials;
- accessed mailboxes;
- exfiltrated messages.
Patching closes the vulnerability.
It does not remove an attacker who already exploited it.
What Should Administrators Check?
Start with authentication and administrative activity.
Look for:
unknown accounts.
unexpected administrator activity.
new SSH keys.
modified configuration files.
unexpected processes.
new scheduled jobs.
unusual outbound connections.
large amounts of mail or data leaving the server.
unexpected mailbox access.
Also check whether credentials stored or used by the Zimbra server have been exposed.
If the server was compromised, assume secrets accessible from that machine may need to be rotated.
That includes credentials for external services.
Don’t Forget the Rest of the Network
A mail server shouldn’t be able to reach everything.
Unfortunately, many organizations still have surprisingly flat internal networks.
If an attacker compromises the mail server and the server can communicate freely with:
domain controllers → file servers → databases → backup systems → internal applications
then the initial compromise can become a much larger incident.
Network segmentation is therefore an important secondary defense.
The goal isn’t necessarily to make compromise impossible.
It’s to make:
one compromised server ≠ entire company.
Why This One Is Worth Watching
We’ve covered plenty of Windows vulnerabilities recently.
But this campaign is a useful reminder that attackers don’t care which operating system dominates the headlines.
They care about:
Internet exposure.
valuable data.
weaknesses that can be automated.
Zimbra is particularly attractive because the system sits at the intersection of all three.
It is Internet-facing.
It handles valuable information.
And once an exploit is available, attackers can scan the Internet for vulnerable installations.
That’s an excellent recipe for mass exploitation.
Bugstoday Opinion
This is the kind of vulnerability where the phrase “we’ll patch it during the next maintenance window” can become dangerous.
If you’re running an Internet-facing mail server, your maintenance window is effectively happening in an environment where attackers are already scanning.
And the numbers from this campaign demonstrate why.
Hundreds of servers are reportedly already compromised.
Thousands more remain potential targets.
The most important question for administrators isn’t:
“Did we install the patch?”
It’s:
“Was our server vulnerable long enough for somebody to exploit it?”
If the answer is yes, investigate.
Because the patch can stop the next attack.
It can’t undo the last one.
Bugstoday verdict: CVE-2026-73570 is another reminder that your email server is one of the most valuable machines on the network. If attackers compromise it, they may not need to crack a single password — they can simply read the organization’s secrets as they arrive in the inbox.
