NewsThe Hacker News2026-09-30 16:46 UTC

Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team. The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol

CVE-2026-73570Synacor Zimbra Collaboration Suite (ZCS) — Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
CVE-2026-73570synacor zimbra_collaboration_suite: Betriebssystem-Befehlsinjektion

Other advisories

CVE-2026-62367none
go code.vikunja.io/api: Authentication Bypass by Spoofing
ghsa:GHSA-4hv6-xc92-j86gmedium
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
osv:GHSA-4hv6-xc92-j86gnone
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
CVE-2026-62367none
go code.vikunja.io/api: Authentication Bypass by Spoofing
CVE-2026-107808none
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
CVE-2026-107808high
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
osv:GHSA-r44w-v6gf-x3p6none
pyLoad has an authentication bypass in API key validation (check_apikey cache)
ghsa:GHSA-r44w-v6gf-x3p6high
pyLoad has an authentication bypass in API key validation (check_apikey cache)

Other news entries

Newsthehackernews2026-10-09
Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access
Newssecurityweek2026-10-09
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
Newssecurityweek2026-10-08
SonicWall and Splunk Patch Critical Vulnerabilities
Newscsoonline2026-10-08
SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug
Newsthehackernews2026-10-07
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
Newsbleepingcomputer2026-10-07
Hackers exploit critical Atlassian flaw after public PoC release
Newsbleepingcomputer2026-10-06
Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes
Newssecurityweek2026-10-03
Fortra Patches Critical Vulnerabilities in BoKS

Source: https://thehackernews.com/2026/09/attackers-exploit-zimbra-flaw-to-deploy.html

Linked advisories

More on Authentication