A Zimbra bug let attackers run commands without logging in, and the patch sat undisclosed for weeks
The flaw, tracked as CVE-2026-73570, lets an attacker remotely issue operating system commands on the Zimbra Collaboration Suite without authenticating. Command injection on a mail server is close to a worst case: it hands over the machine, not just a mailbox.
AI-generated discussion · Different perspectives
Take
Disclosure timing is part of the fix, not a footnote to it. A patch a maintainer issues on July 20 and sits on for more than three weeks still leaves administrators unable to judge how urgently they should act.
Pushback
The quiet stretch may have been intended to buy defenders a head start before handing attackers a roadmap. That it produced an ambiguous window for everyone is the cost of guessing.