PT-2026-27441 · Zimbra · Zimbra Collaboration Suite

Indoushka · Published 2026-03-24 · Updated 2026-03-24 · CVE-2025-71275

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite (ZCS) version 8.8.15

Description A security issue exists in the Zimbra Collaboration Suite (ZCS) PostJournal service that allows unauthenticated attackers to execute arbitrary system commands. This is possible due to improper sanitization of the RCPT TO parameter when handling SMTP injection. Attackers can inject shell expansion syntax through the RCPT TO parameter to achieve remote code execution under the Zimbra service context. The vulnerable parameter is RCPT TO. The affected API endpoint is the SMTP service.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2025-71275

Affected Products

Zimbra Collaboration Suite

References · 9

• 🔥 https://packetstorm.news/files/id/212108 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-71275 · Security Note
• https://twitter.com/CveFindCom/status/2036483865594778052 · Twitter Post
• https://twitter.com/0dayPublishing/status/2036467944763383854 · Twitter Post
• https://twitter.com/TheHackerWire/status/2036536854284267555 · Twitter Post
• https://vulncheck.com/advisories/zimbra-collaboration-suite-postjournal-unauthenticated-remote-code-execution-via-smtp-injection · Note
• https://twitter.com/CVEnew/status/2036505771958206629 · Twitter Post
• https://zimbra.com · Note
• https://twitter.com/OrizonCyber/status/2036480673448390850 · Twitter Post