Threat Actors Leverage Patched Zimbra Bug to Install Web Shells and Steal Credentials

Security researchers at Microsoft have uncovered a campaign in which threat actors weaponized a critical vulnerability in the Zimbra Collaboration Suite (ZCS) to plant malicious web shells and extract authentication data from compromised mailboxes. The flaw, catalogued as CVE-2026-73570 and rated 8.9 on the CVSS scale, allowed unauthenticated attackers to gain remote code execution on vulnerable Zimbra servers.

Zimbra, a widely deployed email and collaboration platform used by enterprises, educational institutions, and service providers, has long been prized for its open‑source flexibility. The newly disclosed weakness resides in the suite's handling of certain HTTP requests, enabling an attacker to upload arbitrary files and execute them with the privileges of the Zimbra service account. Once a web shell is in place, the adversary can issue further commands, download mailbox contents, and harvest session tokens or password hashes.

The Microsoft Security Research team observed the exploitation chain in the wild, noting that the actors first scanned the internet for Zimbra installations that had not yet applied the vendor’s emergency patch. After locating a target, they delivered a crafted request that triggered the vulnerability, then uploaded a PHP‑based web shell to a publicly accessible directory. Subsequent traffic from the compromised host revealed systematic queries for authentication cookies and LDAP credentials, suggesting a broader intent to pivot within the victim’s network.

Although the vulnerability has now been patched by Zimbra, the researchers warn that many organizations remain exposed due to delayed updates or reliance on legacy installations. “The window of opportunity for attackers was relatively short, but the impact can be severe for those who missed the remediation deadline,” the team noted in its advisory. Security experts stress that rapid patch deployment, coupled with routine configuration reviews, is essential to mitigate similar supply‑chain style attacks.

Industry observers say the incident underscores a growing trend of threat actors targeting collaboration tools, which often store sensitive communications and attachments. By compromising a mail server, attackers can harvest a wealth of corporate intelligence, from strategic plans to personal data, without triggering immediate suspicion. The use of web shells also provides a low‑profile foothold that can persist even after the initial vulnerability is addressed, unless thorough forensic sweeps are performed.

Going forward, Zimbra has urged administrators to verify that the latest security updates are installed and to audit server logs for any signs of unauthorized file uploads. Microsoft recommends enabling multi‑factor authentication for mailbox access, tightening network segmentation, and employing intrusion detection systems that can flag anomalous web requests. As the digital ecosystem continues to rely on integrated communication platforms, vigilant patch management and proactive monitoring remain the frontline defenses against such exploitation campaigns.