PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-3401 Synacor CVE debrief

CVE-2016-3401 is an unspecified vulnerability in Zimbra Collaboration that can let a remote authenticated user affect integrity in versions before 8.7.0. The CVE record identifies it as bug 99810 and the NVD entry rates it as a network-reachable issue with high integrity impact but no confidentiality or availability impact. The linked Zimbra release notes and security advisory pages are the primary mitigation references in the supplied corpus.

Vendor
Synacor
Product
Zimbra Collaboration Suite
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Zimbra Collaboration administrators, mail platform owners, and security teams running affected versions up to 8.6.0, especially where authenticated users have access to the system.

Technical summary

The supplied CVE record describes an authenticated remote integrity issue in Zimbra Collaboration before 8.7.0, with the exploit path left unspecified. NVD maps the affected range to versions through 8.6.0 and assigns CVSS v3.0 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indicating network reachability, low attack complexity, required low privileges, no user interaction, and a primary integrity impact. NVD also classifies the weakness as NVD-CWE-noinfo, so the underlying flaw class is not identified in the provided sources.

Defensive priority

Medium. This is a real integrity-impacting issue for an authenticated attack path, but the supplied corpus does not indicate public exploitation or KVE status.

Recommended defensive actions

  • Upgrade Zimbra Collaboration to 8.7.0 or later, using the vendor release notes as the primary remediation reference.
  • Inventory systems running Zimbra Collaboration versions up to 8.6.0 and confirm whether any authenticated users or integrations could reach the affected service.
  • Review authentication and authorization logs for unexpected or unauthorized integrity-related changes around the affected period.
  • Apply least-privilege controls for accounts that can modify Zimbra data or configuration.
  • Track the linked Zimbra security advisories page for any additional vendor guidance or follow-on fixes.

Evidence notes

This debrief is based only on the supplied NVD CVE record and the linked Zimbra release notes/security advisories references. The CVE description states that Zimbra Collaboration before 8.7.0 has an unspecified vulnerability allowing remote authenticated users to affect integrity, also known as bug 99810. The NVD record maps the affected CPE to Synacor Zimbra Collaboration Suite versions up to 8.6.0 and lists CVSS v3.0 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. No exploit details or root-cause specifics are added beyond the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-3401 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-3401

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-3401 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-3401

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.