View Ridge Security
Back to Cyber Hose

Zimbra command injection flaw CVE-2026-73570 under active exploitation

Zimbra mail servers under active exploitation via unauthenticated command injection, plus Star Blizzard phishing and Chrome 154 patches.

🚨 ACTIVE EXPLOITATION

  • Microsoft tracks exploitation of Zimbra command injection flaw CVE-2026-73570 CVE-2026-73570
    Microsoft Threat Intelligence is tracking active exploitation of CVE-2026-73570, an unauthenticated command injection flaw in Zimbra Collaboration Suite.
    • Affects internet-facing Zimbra Collaboration Suite servers running the optional zimbra-snmp package with SNMP notifications enabled; fixed in Zimbra 10.1.20 (July 20, 2026), disclosed August 13, 2026.
    • A crafted SMTP request injects shell commands into SNMP notification processing via swatchdog's snmptrap invocation, executing as the zimbra service account with no authentication or user interaction.
    • Attackers deployed JSP webshells across Jetty and mailboxd paths, reverse shells, cron/systemd persistence, and memory-backed execution via memfd_create, plus privilege escalation.
    • Post-exploitation included access to email and collection of authentication and mailbox data with archive creation and transfer; victims spanned multiple regions and industries.
    • Pre-disclosure probing (July 28–August 7) used out-of-band callbacks to oast.fun, oast.online, dnslog.pp.ua, requestrepo.com, and bypass.eu.org with a ZB73570 User-Agent.
    Sources 📎 Coverage: microsoft.com · 👁 via Microsoft Security Blog

🕵️ RESEARCH & DEEP DIVES

  • Star Blizzard scales RedFlick phishing campaign against 100+ Ukraine-focused organizations
    Russian state-linked group Star Blizzard has scaled a new RedFlick phishing delivery chain to target over 100 organizations.

    • Targets include government, diplomatic, research, public-policy, journalistic, and financial entities working on Ukraine-related matters.
    • Operation is attributed to Star Blizzard (ColdRiver/Callisto), which shifted from narrow spear-phishing to broader initial-contact campaigns; compromised websites were used to create accounts for sending phishing emails.
    • First contact email contains no attachments or exploits—just conversational bait mimicking invitations, policy exchanges, research collaboration, or document sharing.
    • Follow-up delivers a password-protected RAR/ZIP archive with the password shown as an embedded image, evading inspection; a shortcut downloads a PDF with encoded data that PowerShell extracts to fetch an MSI installer via WebDAV.
    • Installers create scheduled tasks, gather system info, enable WebDAV access, and pull components to deploy the CosmicPulse backdoor for persistent Windows access.
    Sources 📄 Source: fieldeffect.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

  • PaperPhone headless browser network uses 75,000 IPs and fake mobile identities across 43 countries
    CrowdSec uncovered a coordinated headless-browser scraping network called PaperPhone that used 75,000 IP addresses and fabricated mobile device identities across 43 countries.

    • Websites relying on IP-based defenses are targeted by large-scale scraping traffic disguised as ordinary mobile browsing from 43 countries.
    • The network spans 75,000 IPs across 230 mostly /24 blocks in 80 networks, largely data-center infrastructure, with over 20% transiting M247 despite blocks not belonging to it.
    • It cycled 13 claimed device identities (Android and iOS) but all bots shared a 375×812 viewport and exposed Google SwiftShader software rendering, contradicting claimed Pixel 9, Galaxy S25 Ultra, and iOS 14/15 sessions.
    • Synchronized request peaks across distant time zones and rotating addresses after challenge failures indicate central coordination rather than independent users.
    • IOCs include ranges 103.216.1.0/24, 62.105.200.0/22 (claimed Brussels), 62.105.204.0/23 (Bangkok), 62.105.208.0/23 (Tokyo), and 62.105.210.0/23 (Paris).
    Sources 📄 Source: crowdsec.net · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

  • Google Chrome 154 update fixes 32 vulnerabilities, including critical ANGLE buffer overflow
    Google released a Chrome Stable update fixing 32 security vulnerabilities across Windows, macOS, and Linux.
    • Applies to Chrome on Windows, macOS, and Linux; update versions 154.0.8037.92/.93 (Windows/Mac) and 154.0.8037.92 (Linux) are rolling out over coming days and weeks.
    • Fixes 32 flaws including one critical ANGLE buffer overflow (CVE-2026-102331) that can corrupt memory and potentially enable code execution in the browser context.
    • Patches multiple high-severity V8 type confusion issues (CVE-2026-102299, -102323, -102326, -102328, -102321) and a V8 buffer overflow (CVE-2026-102302), triggerable via malicious webpages.
    • Also fixes use-after-free flaws in Bluetooth, Views, Passwords, FullScreen, and Picture-in-Picture, plus a high-severity WebUI XSS (CVE-2026-102329) and authorization/privilege issues in Mojo, CORS, Payments, WebView, and SiteIsolation.
    • Google has restricted technical bug details for several vulnerabilities until most users are patched.
    Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

🔓 CVEs & KEV

  • CVE-2026-102427 — ordasoft.com OrdaSoft Joomla CCK — CVSS 10.0 — OS CCK 8.3.16 for Joomla Fixes a No-Login PHP Upload and an SQL Injection, but the Updater Still Offers 8.3.14

  • CVE-2026-76570 — joomcode.com JCTables extension for Joomla — CVSS 10.0 — JCTables for Joomla: Unauthenticated SQL Injection Fixed in 1.21.1

  • CVE-2026-102557 — Red Hat Enterprise Linux 10 — CVSS 8.6 — Libsoup: libsoup: heap buffer overflow during websocket message reassemblyA f...

  • CVE-2026-102556 — Red Hat Enterprise Linux 10 — CVSS 8.6 — Libsoup: libsoup: heap buffer overflow from websocket pong signal type confus...

  • CVE-2026-102633 — libexpat — CVSS 8.2 — libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloclibexpat versio...

  • CVE-2026-47574 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an a...

  • CVE-2026-47541 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the ker...

  • CVE-2026-47536 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the ker...

  • CVE-2026-47535 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the fir...

  • CVE-2026-47521 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the ker...

  • CVE-2026-47520 — NVIDIA Guest driver — CVSS 7.8 — NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the ker...

  • CVE-2026-47519 — NVIDIA Guest driver — CVSS 7.8 — NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the ker...

  • CVE-2026-47503 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual G...

  • CVE-2026-47499 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerabilit...

  • CVE-2026-47498 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP...

  • CVE-2026-47497 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Process...

  • CVE-2026-47495 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerabilit...

  • CVE-2026-47493 — NVIDIA Virtual GPU Manager — CVSS 7.8 — NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GP...

  • CVE-2026-47496 — NVIDIA Virtual GPU Manager — CVSS 7.3 — NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual G...

  • CVE-2026-47539 — NVIDIA Virtual GPU Manager — CVSS

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check