Google Threat Analysis Group

Some of the 50-plus Zimbra bugs Rapid7 found let attackers send mail as someone else without credentials

Rapid7's research with Zimbra turned up more than 50 vulnerabilities, several of which let an attacker send mail as another user with no password involved. The operational item today is CVE-2026-73570, the SNMP command injection CISA gave federal agencies three days to fix.