Zimbra Collaboration Suite Faces Active Root-Level Exploit via Unauthenticated Command Injection

Security researchers have confirmed that attackers are actively exploiting a newly disclosed flaw in the Zimbra Collaboration Suite, identified as CVE‑2026‑73570. The vulnerability permits unauthenticated command injection, allowing threat actors to obtain full system privileges and harvest authentication data from mailboxes.

The flaw resides in the way Zimbra processes certain HTTP requests, where input is passed directly to the operating system without proper sanitisation. By crafting a specially formatted request, an attacker can trigger the execution of arbitrary shell commands on the server, bypassing all normal access controls.

Exploitation of the bug has been observed to result in root‑level access, enabling the creation of persistent back‑doors and the exfiltration of mailbox authentication tokens. With those tokens, malicious actors can impersonate legitimate users, read confidential communications, and potentially spread further malware within the compromised network.

Zimbra Collaboration Suite is widely deployed in corporate, educational, and government environments as a self‑hosted email and collaboration platform. Its open‑source roots and flexible architecture have made it a popular alternative to cloud‑based services, but the same openness can broaden the attack surface when critical patches are delayed.

The vulnerability was initially reported to the public by the security group GBHackers, who provided details of the exploit methodology. In response, the Zimbra development team issued an emergency update that tightens input validation and disables the vulnerable code path. Vendors and administrators are urged to apply the patch immediately and review logs for signs of unauthorized command execution.

Analysts warn that the window for exploitation remains open for systems that have not yet been updated, and that threat actors may continue to target unpatched installations. Organizations are advised to conduct comprehensive scans, rotate compromised credentials, and consider network‑level protections such as web‑application firewalls to mitigate future attempts.