Zimbra Vulnerabilities Could Let Attackers Manipulate Email, Documents and Calendars
Summary
Rapid7 says its Zimbra research uncovered more than 50 vulnerabilities, including flaws that could let attackers impersonate senders, control inbox visibility and alter shared documents and calendars to support convincing business email compromise.
Key points
- Rapid7 says it uncovered more than 50 vulnerabilities in research with Zimbra.
- Some flaws could let attackers impersonate senders without credentials, control inbox visibility, and alter shared documents and calendars.
- The article describes how forged emails, planted documents, and manipulated calendar events could reinforce one another and mislead employees.
- It cites prior Zimbra vulnerabilities that were exploited, including flaws added to CISA's Known Exploited Vulnerabilities catalog.
- The article frames collaboration suites as systems of record whose trusted content can be abused to shape business decisions.
Article Details
- Event Type
- Rapid7 reported discovering more than 50 vulnerabilities in Zimbra Collaboration Suite, including flaws that enable attackers to impersonate senders, manipulate inbox visibility, and alter shared documents and calendars.
- Impact
- The vulnerabilities could enable business email compromise and manipulation of organizational records and decisions. The article also reports exploitation of several Zimbra vulnerabilities, including attacks against Brazilian military targets and more than 260 compromised instances associated with CVE-2026-73570, according to Shadowserver.
CVE
CVE-2022-27925Go back further and the pattern holds. Rapid7 tracked widespread exploitation of CVE-2022-27925 and CVE-2022-37042 in 2022, a path traversal chained with an authentication bypass that let attackers drop a JSP shell on aCVE-2022-37042Go back further and the pattern holds. Rapid7 tracked widespread exploitation of CVE-2022-27925 and CVE-2022-37042 in 2022, a path traversal chained with an authentication bypass that let attackers drop a JSP shell on aCVE-2023-37580Threat Analysis Group later documented four separate threat groups working the same zero-day known as CVE-2023-37580. Each of these groups went after email, credentials, and authentication tokens. Attackers figured outCVE-2024-45519CVE-2024-45519, command injection in the postjournal service, unauthenticated command execution. Proofpoint saw attackers stuffing base64 payloads into CC fields on September 28, 2024. CISA added it to KEV on October 3.CVE-2025-27915CVE-2025-27915, stored XSS in the Classic Web Client, triggered by a crafted .ICS attachment.CVE-2026-73570CVE-2026-73570, unauthenticated command injection through SNMP notification handling.
Vendors
Products
Classic Web ClientCVE-2025-27915, stored XSS in the Classic Web Client, triggered by a crafted .ICS attachment.Zimbra Collaboration Suiteupcoming installments will explore technical details and broader findings based within the Zimbra Collaboration Suite. Our investigation disrupted the traditional BEC model in unexpected ways. We uncovered over 50