CVE-2026-115785
Awaiting Analysis Awaiting Analysis - Queue

SMTP Command Injection in Zimbra Collaboration Suite

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: Rapid7, Inc.

Description
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-23
Last Modified
2026-10-23
Generated
2026-10-23
AI Q&A
2026-10-23
EPSS Evaluated
N/A
NVD
CVE-2026-115785
EUVD
EUVD-2026-109079

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Zimbra Zimbra Collaboration Suite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SMTP command injection vulnerability in Zimbra Collaboration Suite (ZCS). An authenticated user can inject CR/LF characters into the emailAddress field via a JSON SOAP request. This allows manipulation of SMTP envelope commands, enabling the attacker to send emails with arbitrary recipients, headers, and content without further victim interaction after a successful POP3 or IMAP login.

Impact Analysis

An attacker could use this flaw to send phishing emails, spam, or malicious content from your domain. This could damage your organization's reputation, lead to account compromises, or facilitate further attacks. The impact is limited to email spoofing and does not directly compromise system integrity or confidentiality beyond email content.

Compliance Impact

This vulnerability could lead to unauthorized email transmissions, potentially violating data protection requirements under GDPR or HIPAA if sensitive information is exposed or misused. Organizations may face compliance penalties if they fail to prevent such attacks. The impact depends on the specific data involved in the spoofed emails.

Mitigation Strategies

Upgrade Zimbra Collaboration Suite to a version that is not affected by this vulnerability, specifically versions beyond 10.1.16 and 10.1.20. Apply any available patches or updates from Zimbra to address the SMTP command injection issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115785. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart