Vulnerability · Published Oct 23, 2026 · Assigned by rapid7
CVE-2026-115785Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address
Medium 4.3
In plain English
A medium-severity security flaw in Zimbra Collaboration Suite from Zimbra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Official description
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zimbra | Zimbra Collaboration Suite | 0 – through 10.1.20 |
Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N