Zimbra server flaw is exploited through an optional notification component

Microsoft reported on 30 September that attackers exploited an unauthenticated command-injection vulnerability in Zimbra Collaboration Suite. Its account identifies the SNMP notification path and says the observed exposure requires the optional zimbra-snmp package with notifications enabled. A specially crafted email can reach that path without the recipient opening an attachment.

Researchers described web shells, persistent remote access and collection of authentication and mailbox information after exploitation. They combined behaviour from several confirmed intrusions in the report, rather than claiming each server followed every stage. Administrators assessing the advisory need to establish the exact product configuration and inspect for activity after initial access, alongside applying the relevant vendor remediation.