PT-2026-27441 · Zimbra · Zimbra Collaboration Suite

Indoushka · Published 2026-03-24 · Updated 2026-03-24 · CVE-2025-71275

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite (ZCS) version 8.8.15

Description The Zimbra Collaboration Suite (ZCS) PostJournal service version 8.8.15 contains a command injection issue. Unauthenticated attackers can execute arbitrary system commands by exploiting improper sanitization of the RCPT TO parameter via SMTP injection. Attackers can inject shell expansion syntax through the RCPT TO parameter to achieve remote code execution under the Zimbra service context. The vulnerability is triggered through the SMTP protocol, specifically targeting the RCPT TO parameter.

Recommendations Update Zimbra Collaboration Suite (ZCS) to a version beyond 8.8.15.

Exploit

Fix

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2025-71275

Affected Products

Zimbra Collaboration Suite

References · 9

• 🔥 https://packetstorm.news/files/id/212108 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-71275 · Security Note
• https://zimbra.com · Note
• https://twitter.com/OrizonCyber/status/2036480673448390850 · Twitter Post
• https://twitter.com/TheHackerWire/status/2036536854284267555 · Twitter Post
• https://twitter.com/CVEnew/status/2036505771958206629 · Twitter Post
• https://twitter.com/0dayPublishing/status/2036467944763383854 · Twitter Post
• https://vulncheck.com/advisories/zimbra-collaboration-suite-postjournal-unauthenticated-remote-code-execution-via-smtp-injection · Note
• https://twitter.com/CveFindCom/status/2036483865594778052 · Twitter Post