Microsoft Warns of Active Exploitation of Zimbra Collaboration Suite Command-Injection Vulnerability (CVE-2026-73570)
Microsoft has reported that attackers are actively exploiting CVE-2026-73570, a critical unauthenticated command-injection flaw in Zimbra Collaboration Suite, targeting internet-facing mail servers. The vulnerability allows a specially crafted SMTP request to execute arbitrary OS commands through the SNMP notification path when the optional zimbra-snmp package is installed and SNMP notifications are enabled, requiring no authentication or user interaction. Observed attacks included deploying JSP web shells and reverse shells, escalating privileges, establishing persistent remote access, and stealing email, authentication, and mailbox data. The flaw carries a CVSS score of 8.9, and while Shadowserver counted 274 compromised Zimbra instances, the number of internet-visible instances dropped from roughly 19,000 to about 10,000 after a July patch.

The Narrow Backdoor

Read that CVE description again and tell me there isn't a signature on it. CVE-2026-73570: an unauthenticated command injection that only fires when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Not a broad vulnerability — a carefully chiseled keyhole. Someone designed this to be triggered through a specially crafted SMTP request, a protocol that crosses every firewall on earth because mail must always get through. And what does this keyhole grant? Remote command execution. No login. No clicks. No trace. That is not an accident in code. That is an engineering choice, and the only question is whose choice it was. Zimbra is the quiet lifeline of universities, small governments, and mid-sized companies worldwide — not the giants that have their own security armadas, but the institutions that trust open-source software because they believe the community watches the code. Someone was watching. Just not to protect you.

The Body Count Discrepancy

Now look at the numbers, because the people who write these reports think you won't do arithmetic. Microsoft tells us 274 Zimbra instances were compromised. Then Shadowserver says there are roughly 10,000 internet-visible instances left, down from 19,000 after the July patch. Wait — 9,000 servers simply vanished from the internet? That is not a patch rollout. That is a cleanup operation. Either those servers were decommissioned because they were fully hollowed out, or they were quietly moved behind private protections after the attackers had already taken what they came for. And Microsoft observed the whole chain: web shells, reverse shells, privilege escalation, persistent remote access, and the exfiltration of email, authentication hashes, and mailbox data. They had front-row seats. They saw exactly what was taken and from whom, across multiple regions and industries. The mainstream read of that is "Microsoft is sharing threat intel." The real read is that Microsoft had access to every one of those compromised servers. Ask yourself why a software company is monitoring your private mail server in real time. The answer they want you to believe is "defense." The answer the evidence whispers is "collection."

Follow the Mail

This is not about a bug. This is about the architecture of consent. Every communication system that carries the world's secrets must have a designated tap, and the tap has to look like a vulnerability so that when it is (inevitably) discovered, the story is "attackers exploited a flaw" rather than "the state's silent hand reached through the wire." They want you to fear the hackers so you don't look at the ones who write the reports. So who found this first? Was it Microsoft's threat researchers — or was it the same people who ordered the exploitation? The CVE has a severity score of 8.9, high enough to demand attention, but the conditions are so specific that they smell like a contingency plan: if we need to read your mail, we flip this switch. And after the July patch, the visible instance count dropped by almost half — because the tool was no longer needed, or because the servers that mattered were already burned down to the root. Do not let the 274 number comfort you. That is merely the body count they admit to. Go look up Zimbra's SNMP notification design. Go look up Microsoft's threat intelligence sharing agreements with Five Eyes. Go look up the timeline of the July patch. Then you tell me who really reads your email.