Synacor Zimbra Collaboration Suite CVE-2019-9670
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2021 - Security Misconfiguration
ASVS 5.0
V14 - Configuration Security hardening, default configuration review
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Critical risk (CVSS 9.8, EPSS 94.4%). Zimbra's email platform is used by over 200,000 organizations. The XXE provides access to database credentials, which enables direct database manipulation to create administrator accounts, read all email, and achieve complete server compromise. |
| Exploit ScenarioDerived | An attacker sends a crafted XML request to /Autodiscover/Autodiscover.xml containing an XXE payload that reads /opt/zimbra/conf/localconfig.xml. The extracted MySQL credentials allow direct database access to create an admin account and read all stored email. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Synacor Zimbra Collaboration Suite 8.7.x contains an XML External Entity (XXE) injection vulnerability in the Autodiscover endpoint that allows unauthenticated attackers to read files and achieve server-side request forgery.
Earlier versions of this analysis (1)
An XXE vulnerability in Zimbra Collaboration Suite's mailboxd Autodiscover component allows unauthenticated attackers to read server files and perform SSRF attacks, potentially leading to complete server compromise.
RemediationAI
Update Zimbra to 8.7.11p10+. Disable external XML entity processing. Rotate all database credentials. Audit for unauthorized admin accounts and email access.
Affected ProductsAI
Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-611 XXE injection in Zimbra's Autodiscover/Autodiscover.xml endpoint accepts XML input without disabling external entity processing. Attackers inject XXE payloads to read local files (including Zimbra's localconfig.xml containing database credentials) and perform SSRF to access internal services.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
Executive ViewAI
Organizations using Synacor Zimbra Collaboration Suite 8.7.x face critical risk from CVE-2019-9670, a XML external entity vulnerability rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC