EUVD-2026-58069
GHSA-jqh7-pchh-v74j
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
AV:N and PR:N confirmed by SMTP delivery with no auth; AC:H reflects non-default SNMP package requirement; A:H assessed higher than vendor's A:L because arbitrary command execution as zimbra user can disrupt mail services and delete data.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Articles & Coverage 1
AnalysisAI
Remote code execution in Zimbra Collaboration (ZCS) before 10.1.20 enables unauthenticated network attackers to execute arbitrary operating system commands as the Zimbra service account by sending specially crafted SMTP requests that trigger unsanitized input processing in the SNMP notification subsystem. Exploitation is conditional on the non-default zimbra-snmp package being installed and SNMP notifications being enabled, which meaningfully narrows the exposed population despite the CVSS 8.9 score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two non-default deployment conditions to be simultaneously present: (1) the optional zimbra-snmp package must be explicitly installed - it is not part of a standard Zimbra installation and requires deliberate administrative action to deploy - and (2) SNMP notifications must be enabled in the Zimbra configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.9 High score reflects a network-accessible, scope-changing command injection requiring no authentication or user interaction - strong signals of high exploitability if the deployment conditions are met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker with network access to the Zimbra server's SMTP port sends a specially crafted SMTP request containing OS command metacharacters embedded in fields that flow into SNMP notification processing. When Zimbra processes the SMTP transaction and generates an SNMP notification, the unsanitized attacker-controlled input is passed to a shell command, executing arbitrary OS commands as the zimbra user. … |
| Remediation | The primary remediation is upgrading Zimbra Collaboration to version 10.1.20 or later, as documented in the Zimbra Security Advisories at https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify whether the zimbra-snmp package is installed and whether SNMP notifications are enabled in your ZCS deployment; if both are present, immediately disable SNMP notifications to eliminate the attack vector. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Collaboration
View allZimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. Rat
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). Rated high severity (CVSS 7.8), this
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated medium severity (CVSS 6.1), this vulnerability
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preaut
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sen
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before
An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41,
File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obt
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated high severity (CVSS 7.8), this vulnerability i
In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instan
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today