{"id":"CVE-2026-115785","kind":"vulnerability","aliases":["CVE-2026-115785"],"related":[],"title":"Zimbra: authenticated users can inject SMTP commands and send mail","description":"An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.","summary":"Zimbra Collaboration Suite's data-source testing feature does not strip CR/LF characters from the email address placed in an SMTP envelope command. An authenticated user with account options enabled can smuggle extra SMTP commands and send mail with attacker-chosen recipients, headers and body.","severity":"medium","cvss":4.3,"epss":0.00979,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","package","self-hosted","zimbra"],"not_affected_if":["auth-required"],"how_to_check":"- Check the installed Zimbra version with `su - zimbra -c \"zmcontrol -v\"` and compare against the fixed release listed in the advisory.\n- Confirm whether account options and data-source testing are enabled for users, and whether the SMTP service accepts pipelined transactions.","fix":"- Upgrade Zimbra Collaboration Suite to a release newer than `10.1.20`; the sources do not name the exact fixed version.\n- Until patched, unknown whether restricting account option changes is a workable mitigation; the sources do not say.","status":"open","published_at":"2026-10-23T14:17:52+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:37:18+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:37:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Zimbra Collaboration Suite to a release newer than `10.1.20`; the sources do not name the exact fixed version.\n- Until patched, unknown whether restricting account option changes is a workable mitigation; the sources do not say.","reach":"network","title":"Zimbra: authenticated users can inject SMTP commands and send mail","impact":"medium","summary":"Zimbra Collaboration Suite's data-source testing feature does not strip CR/LF characters from the email address placed in an SMTP envelope command. An authenticated user with account options enabled can smuggle extra SMTP commands and send mail with attacker-chosen recipients, headers and body.","category":"package","nicknames":[],"who_cares":["zimbra","self-hosted","email"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker sends mail as the server with chosen recipients and content.","analyst_note":"Confirm the fixed Zimbra version and whether account options must be enabled by default, using the NVD entry and Zimbra's advisory.","how_to_check":"- Check the installed Zimbra version with `su - zimbra -c \"zmcontrol -v\"` and compare against the fixed release listed in the advisory.\n- Confirm whether account options and data-source testing are enabled for users, and whether the SMTP service accepts pipelined transactions.","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Zimbra Collaboration Suite 10.1.16 and 10.1.20 are named as containing the vulnerable command-construction path. Exposure requires a valid user account with account options enabled, and an SMTP service that accepts pipelined transactions. Installations on other versions or with no authenticated users who can use the data-source test function are less likely to be affected; the sources do not confirm this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000677,"input_tokens":3445,"output_tokens":665,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115785':13A,16A '-2026':12A,15A '10.1.16':165C '10.1.20':167C 'accept':134C 'account':51B,93C 'address':40B 'allow':87C 'attack':64B,139C,145C 'attacker-chosen':63B 'attacker-select':144C 'authent':2A,48B,90C 'bodi':69B,150C 'charact':36B 'chosen':65B 'collabor':24B,84C 'command':7A,46B,58B,72C,107C,125C,158C 'command-construct':157C 'construct':159C 'content':151C 'cr/lf':35B,98C 'cve':11A,14A 'data':28B,78C 'data-sourc':27B,77C 'email':17B,39B 'emailaddress':101C 'enabl':53B,95C 'envelop':45B,106C 'extra':56B 'featur':31B 'function':81C 'header':67B,148C 'host':21B 'imap':119C 'inject':5A,73C,97C,124C 'insert':102C 'interact':154C 'json':110C 'login':120C 'mail':10A,61B,142C 'option':52B,94C 'ordinari':89C 'packag':18B 'path':160C 'pipelin':136C 'place':41B 'pop3':117C 'preliminari':116C 'present':162C 'recipi':66B,147C 'request':112C 'select':128C,146C 'self':20B 'self-host':19B 'send':9A,60B,122C 'servic':130C,133C 'smtp':6A,44B,57B,71C,105C,129C 'smuggl':55B 'soap':111C 'sourc':29B,79C 'strip':34B 'submit':141C 'success':115C 'suit':25B,85C 'test':30B,80C 'transact':137C 'user':3A,49B,91C 'victim':153C 'vulner':74C,156C 'without':152C 'zcs':86C,164C 'zimbra':1A,22B,23B,83C,121C","nicknames":[],"mitigations":[],"who_affected":"Zimbra Collaboration Suite 10.1.16 and 10.1.20 are named as containing the vulnerable command-construction path. Exposure requires a valid user account with account options enabled, and an SMTP service that accepts pipelined transactions. Installations on other versions or with no authenticated users who can use the data-source test function are less likely to be affected; the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115785","severity":null,"published_at":"2026-10-23T14:17:52+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115785","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115785","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}