Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
2026-07-23T19:24:10Z•a799ca6c490678249ead1cfed1585c42bf1ff43347b5bb0503b0354b6d91f388
2faadobe-acrobat-extensionauthentication-bypassazure-devopschaos-ransomwarecheck-pointcredential-theftespionagegithub-actionsheadless-browser-c2hermeticreaderjadeproxlocal-privilege-escalationmsaRATpath-traversalprompt-injection-issue-mscpserver-mcp-azure-devops-mcp-flaw-aircerefluxfssharepointsnap-confinesupply-chaintriback-loaderwindmillzero-dayzimbra
What happened
Multiple high-impact incidents and vulnerabilities reported: a Russian state-supported group exploited a Zimbra webmail zero-day to exfiltrate up to 90 days of email, address books, saved passwords and 2FA recovery codes; multiple actively exploited critical RCE/auth-bypass flaws were disclosed or patched (notably SharePoint CVE-2026-50522 and Check Point SmartConsole CVE-2026-16232). Other notable disclosures include local privilege escalations (RefluXFS CVE-2026-64600, snap-confine CVE-2026-8933), an unauthenticated Windmill path-traversal (CVE-2026-29059), a chained Adobe Acrobat extension/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- a799ca6c490678249ead1cfed1585c42bf1ff43347b5bb0503b0354b6d91f388
- Enrichment time
- 2026-07-23T19:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.