Live › vulnerability › CVE-2026-115785
Go to dashboardZimbra Collaboration Suite's data-source testing feature does not strip CR/LF characters from the email address placed in an SMTP envelope command. An authenticated user with account options enabled can smuggle extra SMTP commands and send mail with attacker-chosen recipients, headers and body.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Zimbra Collaboration Suite 10.1.16 and 10.1.20 are named as containing the vulnerable command-construction path. Exposure requires a valid user account with account options enabled, and an SMTP service that accepts pipelined transactions. Installations on other versions or with no authenticated users who can use the data-source test function are less likely to be affected; the sources do not confirm this.
No product ranges from the sources yet.
su - zimbra -c "zmcontrol -v" and compare against the fixed release listed in the advisory.10.1.20; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
This page as .md · .json · in your agent: get_signal("CVE-2026-115785")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.