A critical remote code execution vulnerability, tracked as CVE-2026-45519 (CVSS 9.8), is under active in-the-wild exploitation against Zimbra Collaboration Suite (ZCS) instances. The defect resides in the postjournal daemon, which processes incoming messages for mail journaling over SMTP. Due to unsanitized envelope metadata passed directly to the POSIX popen call, an unauthenticated remote adversary can achieve command injection by transmitting crafted SMTP messages to TCP port 25 with base64-encoded payload strings embedded in the email CC header.

Following public technical disclosure and proof-of-concept release by ProjectDiscovery, telemetry confirmed automated exploitation targeting internet-exposed Zimbra servers. Threat actors leverage the injection vector to write persistent JSP web shells into webroot directories, executing subsequent commands via customized HTTP cookie triggers under zimbra user privileges. Zimbra resolved the vulnerability in 9.0.0 Patch 41, 10.0.9, 10.1.1, and 8.8.15 Patch 46 by replacing popen with parameterized execvp execution; operators can disable postjournal via local configuration to prevent exploitation.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unauthenticated command execution via standard SMTP email delivery bypasses perimeter firewalls and web application defenses without requiring credentials, transforming routine message ingestion into immediate host compromise and privileged web shell persistence.
• Bullet 2 — Strategic & Defender Imperative: Mail administrators must immediately apply the corresponding Zimbra security patches or disable the postjournal service (zmlocalconfig -e postjournal_enabled=false), inspect MTA access logs for suspicious CC fields, and audit webroot directories for unauthorized JSP files.