Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

Reported 30 Sep 2026 by otx · Severity: medium

Microsoft Threat Intelligence identified active exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite's SNMP notification path. Exploitation occurred between patch availability on July 20, 2026 and public disclosure on