CVE-2026-115785 Zimbra CVE debrief

Who should care

Defenders responsible for Zimbra Collaboration Suite deployments, particularly those with account options enabled, should assess exposure and prioritize mitigation. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-115785 is an SMTP command injection vulnerability in Zimbra Collaboration Suite that allows an authenticated user to inject CR/LF into an SMTP envelope command, potentially leading to mail submission with attacker-selected recipients, headers, and body content. Defenders responsible for Zimbra deployments should assess exposure and prioritize mitigation.

• Potential mail submission with attacker-controlled content
• Possible exploitation by authenticated users with account options enabled
• Verification of ZCS version and configuration required
• Monitoring for suspicious SMTP activity recommended

Technical summary

The vulnerability allows an authenticated user to inject CR/LF into an SMTP envelope command by a JSON SOAP request, potentially leading to mail submission with attacker-selected recipients, headers, and body content. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20, and it requires a successful preliminary POP3 or IMAP login. Defenders should prioritize verifying and mitigating this vulnerability in ZCS 10.1.16 and 10.1.20, as it allows for potential mail submission with attacker-controlled content.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in ZCS 10.1.16 and 10.1.20, as it allows for potential mail submission with attacker-controlled content.

Recommended defensive actions

• Verify and update Zimbra Collaboration Suite to a non-vulnerable version
• Restrict access to the data-source testing functionality
• Monitor for suspicious SMTP activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is present in ZCS 10.1.16 and 10.1.20. An attacker must have an ordinary authenticated user account with account options enabled to exploit this vulnerability. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20, and it allows an attacker to inject CR/LF into an SMTP envelope command by a JSON SOAP request.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.