Recommended Free Tools
Microsoft observed activity probing Zimbra’s CVE-2026-73570 command-injection flaw from July 28 through August 7, 2026. The important chronology: Zimbra had already released the fix in version 10.1.20 on July 20, while the CVE was not publicly disclosed until August 13. The activity therefore occurred after the patch became available but before public disclosure—not throughout a period when no fix existed.
What happened, and when?
CVE-2026-73570 affects a Zimbra Collaboration Suite (ZCS) SNMP notification path. Microsoft says it observed two distinct out-of-band scanning tools probing the vulnerable injection point between July 28 and August 7, 2026. Those observations describe tools and probing activity, not a count of victims or confirmed compromises.
As an Amazon Associate I earn from qualifying purchases.
| Date | Event |
|---|---|
| July 20, 2026 | Zimbra 10.1.20, containing the remediation, was released, according to Microsoft. |
| July 28–August 7, 2026 | Microsoft observed probing of the vulnerable injection path using two distinct out-of-band scanning tools. |
| August 13, 2026 | The CVE was publicly disclosed, according to Microsoft; the Canadian Centre for Cyber Security also identifies affected Zimbra releases as of this date. |
| August 21, 2026 | CISA added the CVE to its Known Exploited Vulnerabilities catalog, as reported by the Canadian Centre for Cyber Security. |
Which Zimbra installations are affected?
The affected configuration is ZCS earlier than 10.1.20 with both the optional zimbra-snmp package installed and SNMP notifications enabled. The flaw does not affect an installation merely because it runs Zimbra: exposure depends on the vulnerable version and those SNMP conditions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The Zimbra security advisories list the SNMP notification command-injection fix in version 10.1.20. Singapore’s Cyber Security Agency rates the vulnerability CVSS v3.1 8.9 out of 10 and recommends immediate updating in its August 21 alert.
#1 Best Overall
- HP ProLiant DL360 G7 Business Server, the perfect enterprise server or small business server!
- Processors: Dual (2) Xeon X5675 6-Core 3.06 GHz 12MB CPUs Max Turbo 3.46 GHz
- Memory: 72GB (4 x 16GB) DDR3 PC3-10600R Memory; Storage: 3.6TB (4 x 900GB) 10K 12Gb/s SAS 2.5" HDDs
- Power: Redundant Power Supplies; RAID: HP Smart Array P410i-a 12Gb/s with 4×GigaBit NIC
- Hard drives and memory upgrades included separately NOT installed, installation required.
How does the command injection work?
Microsoft describes a specially crafted SMTP request that introduces untrusted input into Zimbra’s SNMP notification processing. A service-state change can trigger health monitoring; the swatchdog process then includes the attacker-controlled value in a shell invocation of snmptrap. If the optional package is present and notifications are enabled, injected commands can run with the privileges of the zimbra service account.
Microsoft says the attack requires neither authentication nor user interaction. Its account of observed probes includes commands such as curl, wget, ping, nslookup, and id, with checks for command execution over HTTP, DNS, ICMP, and in-band channels.
Rank #2
- [CPU] AMD Ryzen 7 5700G Processor (8 Cores, 16 Threads, 3.8 GHz Base Clock Speed up to 4.6 GHz Max Boost Clock Speed) for Gaming and Content Creation with 7nm Leading Edge Technology | [STORAGE] 2TB PCIe NVMe M.2 SSD - Experience Hyper-Fast Bootup and Data Transfer thats up to 30x Faster Performance than a Traditional Hard Drive.
- Graphics: Integrated AMD Radeon Graphics | [RAM] 32GB DDR4 RAM 3200 Gaming Memory for Seamless Multitasking from Multiple Web Pages to Playing Games Online Simultaneously | [OS] Windows 11 Pro x64
- 2x 3.5" Drive Bays | 4x Expansion Slots | mATX Motherboard | ATX PSU
- [BUY WITH CONFIDENCE] Empowered PCs are Assembled in the USA, Rigorously Stress-Tested Before Shipping, and Supported with Lifetime Technical and Diagnostic Support and 3-Year Limited Hardware Warranty.
What did investigators observe after probing?
Across the activity it investigated, Microsoft reports JSP web shells, reverse shells, privilege escalation, persistent remote-access tooling, and memory-backed execution. It also reports access to email and collection of authentication and mailbox data. These are campaign-level findings: Microsoft cautions that its composite attack-chain figure combines behavior across confirmed compromises, and no single host necessarily showed every stage.
Free tools Windows power users keep installed
One-click scans. No signup required.
In one incident, attackers archived mailbox backups to /opt/zimbra/final.tar.gz and attempted an AzCopy transfer to Azure Blob storage. Microsoft says the available evidence did not establish that the transfer completed. A staging step or transfer attempt is not proof of successful exfiltration.
Rank #3
- Dell PowerEdge R730xd 24B SFF 2U Server
- 2x Intel Xeon E5-2690 v4 2.6Ghz 14-Core (28-cores Total)
- 128GB DDR4 RAM – 4x 1.2TB 10K SAS 2.5” 12Gb/s
- Dell H730P mini 2GB 12Gb/s RAID
- 2x 750W PSU - 2x 10Gb SFP+ 2x 1Gb (RJ45) NIC
Microsoft observed affected organizations in more than one region and industry, but its report does not state a victim total or a population-wide exploitation count. Its investigated cases should not be treated as an estimate of all affected organizations.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should Zimbra administrators do?
Upgrade to a fixed release
- Upgrade ZCS to version 10.1.20 or later. Microsoft’s guidance is to patch immediately.
- Confirm the installed version after the upgrade and review the Zimbra security advisory for release-specific details.
Reduce exposure if you cannot patch immediately
- Uninstall the optional
zimbra-snmppackage. - Disable SNMP notifications.
- Restrict SNMP and SMTP access to trusted hosts.
These are interim mitigations; they do not replace upgrading to a fixed release.
Rank #4
- Spacious Chassis: This huge 4U server case comes with 15 internal 3.5" HDD bays.
- Expandable & E-ATX Compatible: 7 PCI expansion slots and E-ATX compatibility gives you growth options for all of your needs.
- Exceptional Cooling: 8 pre-installed cooling fans provide excellent airflow and heat protection. 3 front 120mm PWM fans, 3 middle 120mm fans and 2 rear 80mm fans ensure your drives and chassis avoid overheating.
- Desired Features: Front panel LED indicators for power, HDD, and LAN status monitoring allow quick, easy visual assessment. Additional utility with 2 USB 3.0 port and built-in front panel lock.
Investigate possible compromise separately
Prioritize incident response if an internet-facing mail server shows evidence of a reverse shell or other unauthorized command execution. Scope and contain affected systems, review services and persistence mechanisms, and rotate Zimbra authentication secrets and domain zimbraPreAuthKey values as appropriate to the incident. Do not rely only on malware-family detections: Microsoft notes that some consequential activity used a plain interactive shell without a malware-family label.
Applying the patch remediates the vulnerable software version, but it does not establish that a server exposed before the upgrade was never compromised. Treat version remediation and investigation of prior exposure as separate tasks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
