Rapid7 finds fifty Zimbra flaws that let an attacker edit the mailbox
Victoria Shinder1 min readRapid7 has opened a series on collaborative research with Zimbra and puts the headline figure up front: more than fifty vulnerabilities found in the Zimbra Collaboration Suite. The part that separates this from an ordinary bug count is the capability described. Several of the issues let an attacker impersonate a sender without holding any credentials, control what appears in a user's inbox, and alter shared documents and calendars.
The write-up sets that against Zimbra's recent record. CVE-2024-45519, a command injection in the postjournal service, allowed unauthenticated command execution; Proofpoint observed base64 payloads in CC fields on 28 September 2024 and CISA added it to the Known Exploited Vulnerabilities catalog on 3 October. CVE-2025-27915, a stored cross-site-scripting flaw in the Classic Web Client triggered by a crafted .ICS attachment, was used as a zero-day against Brazilian military targets to steal mail and set forwarding filters, and reached the KEV catalog in October 2025.
What it means
Business email compromise is usually modelled as surveillance: someone is in the mailbox, watching approvals, waiting for an invoice. Every control built around that assumption asks whether a message is genuine. Read this research and the assumption weakens. If a sender can be forged without credentials and a calendar entry can be rewritten, the mailbox stops being a record of what happened and becomes a surface an attacker can compose.
The practical consequence is that out-of-band confirmation is not a belt-and-braces nicety for large payments, it is the only channel that survives the described attacks. And a platform with three years of entries in the KEV catalog deserves patch scheduling that assumes exploitation before disclosure, not after.