Zimbra Collaboration
CVE-2025-62763
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Zimbra account
-
DeliveryCraft malicious chat proxy request
-
ExploitTrigger SSRF via chat proxy
-
ExecutionReach internal/restricted services
-
ImpactExfiltrate or manipulate internal responses
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session on Zimbra Collaboration (ZCS before 10.1.12) with access to the chat feature; exploitation leverages the configuration of the chat proxy to issue server-side requests. Limiting factors: valid credentials are needed (PR:L, so not remote-unauthenticated), the chat proxy functionality must be configured/reachable, and the realistic impact depends on what internal services are reachable from the Zimbra host. No user interaction by a victim is required. |
| Impact | This is a moderate, authenticated SSRF (CWE-918) in Zimbra Collaboration, and the signals are internally consistent at the lower-mid tier. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N, base 5.0) indicates a network-reachable but authenticated (PR:L) flaw with a scope change - consistent with a proxy pivoting requests into internal systems - but with only low integrity impact and no confidentiality or availability impact claimed. The EPSS score of 0.26% (16th percentile) is low, indicating no significant observed exploitation activity. There is no CISA KEV listing and no public exploit identified at time of analysis. Collectively these put this below top patch priority in isolation: it is not a high-CVSS-but-overrated issue so much as a genuinely mid-severity authenticated bug. The caveat worth flagging: SSRF of this class frequently carries real confidentiality impact (reading internal metadata/services) even though the vendor/NVD vector sets C:N - defenders should not assume zero data exposure. Given Zimbra's history as a repeatedly and aggressively targeted enterprise platform, chaining potential makes patching to 10.1.12 advisable despite the modest standalone score. |
| Exploit ScenarioDerived | An authenticated Zimbra user abuses the misconfigured chat proxy to coerce the server into issuing attacker-controlled requests to internal network resources (e.g., cloud metadata endpoints or internal-only services), using the server as a pivot behind the firewall. Because scope is changed, responses or side effects can reach systems the attacker could not otherwise access. No public exploit is identified at time of analysis, and exploitation requires valid account access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Server-side request forgery in Zimbra Collaboration Suite (ZCS) before 10.1.12 lets an authenticated user who can reach the chat feature abuse the misconfigured chat proxy to make the Zimbra server issue requests to internal or otherwise unreachable network services. The vulnerability carries a CVSS of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C) and is rated low by threat intelligence signals - EPSS is only 0.26% (16th percentile) and there is no public exploit identified at time of analysis - because the attacker must already hold valid credentials and the chat proxy must be configured and reachable. Exploitation requires no victim interaction, but real-world impact is bounded by which internal services the Zimbra host can reach; our independent assessment rates the confidentiality impact as low (C:L/I:N) rather than the integrity impact NVD records.
RemediationAI
Vendor-released patch: upgrade Zimbra Collaboration Suite to version 10.1.12 or later, as documented in the vendor patch release notes at https://blog.zimbra.com/2025/10/patch-release-update-zimbra-10-1-12/ and https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.12. Until the upgrade can be scheduled, the most effective compensating control is to disable or block the chat proxy entirely if the chat feature is not in active use - this removes the vulnerable code path but sacrifices chat functionality for all users; note that the SSRF is only exploitable by an authenticated account, so tightening mailbox/account provisioning and reviewing privileged or shared accounts reduces the pool of possible attackers. Network-layer controls also materially reduce impact given the Scope:Changed rating: place the Zimbra host in a segmented VLAN with egress filtering that denies server-initiated traffic to RFC1918 ranges, loopback, link-local, and cloud metadata addresses (169.254.169.254), and restrict what internal services the Zimbra host can reach - the trade-off is that legitimate chat backend communications must be explicitly allow-listed to avoid breaking chat. Monitor Zimbra logs for anomalous outbound requests originating from the chat proxy process, and consult https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories for any updated vendor guidance or hotfixes applicable to older release branches.
Affected ProductsAI
Zimbra Collaboration Suite (ZCS) versions before 10.1.12 are affected, specifically where the chat proxy feature is deployed and configured; the flaw is fixed in the 10.1.12 release. No CPE enumeration accompanied the advisory data, so version identification should be done against the vendor's own documentation at https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.12 and the release's Security Fixes section (https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.12#Security_Fixes). Administrators should consult the Zimbra Security Center (https://wiki.zimbra.com/wiki/Security_Center) and the Zimbra Security Advisories page (https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories) to confirm whether a given installation, including any 9.x or earlier branch, falls inside the affected range, and should verify their current build via the Zimbra version banner or zmcontrol -v before applying updates.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic server-side request forgery (CWE-918) rooted in the configuration of Zimbra's chat proxy component. The chat proxy is the intermediary that Zimbra's chat service uses to forward client requests toward the chat backend (tyipcally a separate service/port on the internal network), and its trust boundaries and target resolution logic are is what breaks: because the proxy accepts user-controlled request parameters and does not adequately restrict the destination, an authenticated user can redirect those requests to arbitrary hosts, including loopback, RFC1918 addresses, or cloud metadata endpoints. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) confirms the attack is network-reachable, low complexity, and requires low privileges - i.e. an authenticated account, not an unauthenticated internet attacker - with no victim user interaction. The Scope:Changed rating indicates the vulnerable chat proxy can affect resources beyond its own security authority (the internal network it fronts), which is precisely the SSRF trust-boundary escape. Given the vector, the practical exposure is information disclosure from reachable internal services (our assessment favors C:L over NVD's I:L), and the severity therefore hinges heavily on network segmentation around the Zimbra host. No CPE data was supplied, but the affected code path is version-bound to ZCS builds prior to 10.1.12.
Know when Zimbra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Authenticated chat user (PR:L) sends network requests (AV:N/AC:L/UI:N); proxy pivots to internal systems (S:C); SSRF typically discloses internal responses so C:L rather than vendor's I:L.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Remote code execution in Zimbra Collaboration (ZCS) before 10.1.20 enables unauthenticated network attackers to execute
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. Rat
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch
A critical unauthenticated remote code execution vulnerability exists in Zimbra Collaboration Suite PostJournal service
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) be
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). Rated high severity (CVSS 7.8), this
Unspecified vulnerability in Zimbra Collaboration Server 7.2.5 and earlier, and 8.0.x through 8.0.5, has "critical" impa
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated medium severity (CVSS 6.1), this vulnerability
Unauthenticated remote attackers who can reach an existing publicly shared Briefcase document can abuse unsigned save fi
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preaut
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sen
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove
GitHub PoC
Exploit-DB