Which versions of Zimbra Collaboration Suite are affected by CVE-2025-71275?

A critical remote code execution vulnerability in Zimbra Collaboration Suite (CVE-2025-71275) allows unauthenticated attackers to execute arbitrary commands on affected mail servers.

Is there a public PoC exploit available for CVE-2025-71275?

Yes, a public proof-of-concept exploit is available for CVE-2025-71275. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2025-71275?

Within 24 hours: Inventory all Zimbra installations and identify systems running version 8.8.15; immediately isolate affected servers from untrusted networks or restrict SMTP access to trusted sources only. Within 7 days: Implement network segmentation to limit Zimbra exposure; deploy WAF rules to block RCPT TO parameters containing shell metacharacters; monitor logs for exploitation attempts. Within 30 days: Upgrade to a patched Zimbra version or migrate to an alternative mail platform; conduct forensic analysis of all affected systems for signs of compromise.

Zimbra Collaboration Suite CVE-2025-71275

Q: What is the CVSS score of CVE-2025-71275?

CVE-2025-71275 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2025-208960 CRITICAL

Command Injection (CWE-77)

2026-03-24 VulnCheck

GHSA-4cgv-84wm-gp2c

RCE Command Injection Zimbra Collaboration Suite

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 25, 2026 - 16:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 24, 2026 - 15:45 euvd

EUVD-2025-208960

Analysis Generated

Mar 24, 2026 - 15:45 vuln.today

CVE Published

Mar 24, 2026 - 15:21 nvd

CRITICAL 9.3

DescriptionCVE.org

A critical security vulnerability exists in Zimbra Collaboration Suite (ZCS) PostJournal service version 8.8.15 that allows unauthenticated attackers to execute arbitrary system commands via SMTP injection. The vulnerability is triggered through improper sanitization of the RCPT TO parameter, enabling command injection using shell expansion syntax (e.g., $(COMMAND)). Successful exploitation results in remote code execution under the Zimbra service context without requiring authentication.

Articles & Coverage 1

vuln.today Threat Landscape 23/03-30/03/2026: Supply Chain Attacks and Auth Failures Surge Mar 30, 2026

AnalysisAI

A critical unauthenticated remote code execution vulnerability exists in Zimbra Collaboration Suite PostJournal service version 8.8.15, allowing attackers to execute arbitrary system commands via SMTP injection through improper sanitization of the RCPT TO parameter using shell expansion syntax. A publicly available proof-of-concept exploit exists (PacketStorm), significantly increasing exploitation risk. With a CVSS score of 9.8 and network-accessible attack vector requiring no authentication or user interaction, this represents an immediate threat to exposed Zimbra installations.

Technical ContextAI

The vulnerability affects the PostJournal service component of Zimbra Collaboration Suite (CPE: cpe:2.3:a:zimbra:zimbra_collaboration_suite), a widely-deployed enterprise email and collaboration platform. The root cause is CWE-77 (Command Injection), specifically through improper neutralization of special elements used in OS commands within the SMTP protocol handler. The RCPT TO parameter, which normally specifies email recipients, fails to sanitize shell metacharacters such as $() command substitution syntax. When processing SMTP transactions, the service passes unsanitized user input directly to system command execution contexts, allowing attackers to inject arbitrary commands that execute with Zimbra service privileges. This affects the core mail routing infrastructure where SMTP commands are processed before authentication occurs.

RemediationAI

Organizations running Zimbra Collaboration Suite 8.8.15 should immediately consult the VulnCheck advisory at https://www.vulncheck.com/advisories/zimbra-collaboration-suite-postjournal-unauthenticated-remote-code-execution-via-smtp-injection and Zimbra's official communications at https://www.zimbra.com/ for patch availability and upgrade instructions to a remediated version. Until patching is completed, implement compensating controls including restricting SMTP access to the PostJournal service through firewall rules allowing only trusted mail relay IP addresses, deploying an SMTP proxy or gateway with input validation to filter malicious RCPT TO parameters containing shell metacharacters, and monitoring SMTP logs for command injection attempts (specifically $() syntax in recipient fields). Given the critical nature and public exploit availability, emergency patching should be prioritized over typical change management windows.