Microsoft catches hackers exploiting Zimbra bug before disclosure

Summary

Microsoft observed attackers exploiting a Zimbra mail server vulnerability weeks before it received a CVE identifier and was publicly disclosed.

Key facts

• Microsoft detected attackers probing the Zimbra mail server flaw before disclosure.
• The attacks occurred weeks before the flaw had a CVE to its name.
• The event was reported on 2026-10-01.

Why it matters

Organizations running Zimbra mail servers should treat pre-disclosure exploitation as a real risk, since attackers acted before a CVE or patch was available.