Security Analyst: 2026-09-30

1. Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

   Microsoft Threat Intelligence, 2026-09-30. Read, 25 min.

   Microsoft Threat Intelligence reports exploitation of CVE-2026-73570, an unauthenticated OS command injection in the Zimbra Collaboration Suite SNMP notification path that affects internet-facing servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and observed affected organizations in more than one region and industry. The fix is not new, having shipped in Zimbra 10.1.20 on July 20, 2026 before the CVE was disclosed on August 13, and the observed follow-on activity included web shells and collection of authentication and mailbox data.

   Why it matters for this role: Search archived logs beyond a 30-day hunting window on Zimbra hosts, as Microsoft notes the early exploitation it tracked is older than that window.

2. About the security content of iOS 26.7.1 and iPadOS 26.7.1

   Apple, 2026-09-28. Read, 2 min.

   Apple released iOS 26.7.1 and iPadOS 26.7.1 on September 28, 2026 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics through which processing a maliciously crafted file may lead to arbitrary code execution. Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

   Why it matters for this role: Start with the iPhones of people most likely to be singled out, given that the report Apple cites describes an attack on specific targeted individuals.

Security Analyst