Zimbra Collaboration Suite EUVD-2026-109079

Requires: (1) valid credentials for an ordinary Zimbra account that has account options enabled - a specific per-account configuration, not a default guarantee; (2) use of the data-source testing functionality reachable via JSON SOAP; (3) injection of CR/LF into the emailAddress field so commands enter the SMTP envelope; and (4) a target SMTP service that accepts the pipelined transaction after Zimbra's preliminary POP3 or IMAP login succeeds - if that service rejects pipelining, the injection does not deliver mail. Confirmed affected on ZCS 10.1.16 and 10.1.20. Limiting factors: authentication is mandatory (no anonymous path), the vulnerable account-options feature must be enabled, and no victim interaction is needed once those hold. The description does not name a confirmed fixed/patched version.

Signals point to a moderate, prioritize-this-month issue rather than an emergency. The input CVSS of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects a network-reachable but authentication-gated flaw with only limited integrity impact and no confidentiality or availability impact, which matches the description: an ordinary authenticated user (PR:L) abuses the data-source testing SOAP call to inject SMTP commands. No EPSS score, no SSVC automatable/technical-impact breakdown, and no CISA KEV entry were provided, so exploitation-probability modeling cannot be done from this data. There is no confirmed weaponized exploit; however the Rapid7 research blog referenced here is a detailed public technical write-up by the reporting party, so defenders should assume the mechanism is publicly understood even though the input does not label it as confirmed working exploit code. The vuln.today Decision label is 'this_month' (not act_now/emergency), consistent with the medium CVSS and the authentication prerequisite. Net: a credible, publicly-documented abuse path for authenticated spoofing/mail-injection, but gated by valid credentials plus specific account configuration and a cooperating SMTP service - real enough to patch on a planned cycle, not a drop-everything event.

An attacker who holds any ordinary Zimbra account with account options enabled issues a JSON SOAP data-source test request, placing CR/LF plus crafted SMTP verbs inside the emailAddress field so the injected commands ride into the SMTP envelope after Zimbra completes its preliminary POP3/IMAP login. If the target SMTP service accepts the pipelined transaction, the attacker submits email with attacker-chosen recipients, headers and body - enabling spoofing and unsolicited mail with no victim interaction. A public technical write-up of this technique exists (Rapid7 blog), though the input does not confirm it as a ready-to-run working exploit.