---
id: "CVE-2024-45519"
kind: "vulnerability"
aliases: ["CVE-2024-45519"]
title: "synacor zimbra collaboration suite: The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Synacor Zimbra Collaboration Suite (ZCS)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": ["8.8.15"], "affected": "< 8.8.15", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": ["10.0.9"], "affected": ">= 10.0.0, < 10.0.9", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 8.8.15", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 9.0.0", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 10.1.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "mail-server", "package", "self-hosted", "zimbra"]
not_affected_if: ["managed-hosting"]
published_at: "2024-10-02T22:15:02+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-45519", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45519", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# synacor zimbra collaboration suite: The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before…

Zimbra Collaboration Suite has an unspecified flaw in its postjournal service that lets an unauthenticated user run commands. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Synacor Zimbra Collaboration Suite (ZCS) affected ? fixed ?
- vendor:synacor zimbra collaboration suite affected < 8.8.15 fixed 8.8.15
- vendor:synacor zimbra collaboration suite affected >= 10.0.0, < 10.0.9 fixed 10.0.9
- vendor:synacor zimbra collaboration suite affected = 8.8.15 fixed ?
- vendor:synacor zimbra collaboration suite affected = 9.0.0 fixed ?
- vendor:synacor zimbra collaboration suite affected = 10.1.0 fixed ?

## Fix

Apply the vendor mitigation per Synacor/Zimbra instructions, or stop using the product if no mitigation exists (per CISA required action).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-45519
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-45519

## From the sources

Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_