Microsoft warns of active attacks on Zimbra mail servers

Microsoft says attackers exploited CVE-2026-73570 in Zimbra servers to install remote-access tools and collect credentials and mailbox data, Ars Technica reports. The attack requires an optional SNMP package and enabled notifications. Zimbra 10.1.20 contains the fix; Microsoft’s evidence shows attempted data transfers but does not confirm they completed.