CVE-2024-45519

CRITICAL

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

CVSS v3.1 Score

10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 10/2/2024Modified: 6/17/2026

Related Intelligence (1)

CRITICALZero Day

When Business Email Compromise Starts Rewriting Reality

Business Email Compromise (BEC) operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series around Rapid7's collaborative research with Zimbra; upcoming installments will explore technical details a

CVE-2024-45519CVE-2025-27915
Rapid7

References (8)

https://wiki.zimbra.com/wiki/Security_CenterRelease Noteshttps://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_FixesRelease Noteshttps://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_FixesRelease Noteshttps://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_FixesRelease Noteshttps://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_FixesRelease Noteshttps://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyNot Applicablehttps://blog.projectdiscovery.io/zimbra-remote-code-execution/Exploithttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45519US Government Resource