Zimbra Exploited in the 24-Day Silence Between Patch and Bulletin
A Zimbra flaw patched on July 20 sat unmentioned for three weeks. Attackers found it first. Microsoft says hackers began exploiting CVE-2026-73570, a high-severity OS command injection bug in Zimbra Collaboration Suite, between the patch release and public disclosure. The gap between fix and bulletin was 24 days. Two out-of-band scanning tools were observed probing…