CVE-2024-45519Active Exploitation(synacor / zimbra_collaboration_suite)

MEDIUMCVSS 9.8 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for synacor zimbra_collaboration_suite systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

5.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-10-24. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weakness type (CWE)
CWE-78

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • zimbra_collaboration_suite

Threat summary

  • Active exploitation appears in 5 classified signals
  • Public PoC is present in monitored signal
  • 7 mentions across 6 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 5 signals
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 6 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-08-25); latest day: 1
  • 7 total mentions across 6 days

Affected systems

Vendors
Products
zimbra_collaboration_suite

3 versions affected across 1 product

Deep dive

Activity timeline7 mentions / 6d
01122Mentions · 2026-02-03: 1Mentions · 2026-08-21: 1Mentions · 2026-08-22: 1Mentions · 2026-08-25: 2Mentions · 2026-08-26: 1Mentions · 2026-09-30: 1PoC Mentioned / Linked · 2026-02-03: 1Active Exploitation · 2026-08-21: 1Active Exploitation · 2026-08-22: 1Active Exploitation · 2026-08-25: 2Active Exploitation · 2026-08-26: 1Technical Details · 2026-02-03: 1Technical Details · 2026-08-21: 1Technical Details · 2026-08-22: 1Technical Details · 2026-08-25: 2Technical Details · 2026-08-26: 102-0308-2108-2208-2508-2609-30
Signal classification2 categories
Active Exploitation
583.3%
Disclosure
116.7%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-02-031
Disclosure1
2026-08-211
Active Exploitation1
2026-08-221
Active Exploitation1
2026-08-252
Active Exploitation2
2026-08-261
Active Exploitation1
Full discourse7 posts
  • Aviatrix Threat Research Center@aviatrixtrc

    TRC analysis shows attackers exploiting CVE-2024-45519 in Zimbra mail servers to deploy webshells and escalate to root access. Once inside, they used existing SSH keys to pivot across trusted cluster nodes. Runtime segmentation helps contain lateral movement between mail infrastructure components. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/zimbra-command-injection-cve-2026-73570

    0000050
    2.0K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploited CVE-2024-45519 to achieve remote code execution on 270+ Zimbra servers, enabling lateral movement through compromised email infrastructure. Runtime segmentation helps contain post-compromise activity in breached environments. #ThreatIntel 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/hackers-breached-270-zimbra-servers-cve-2026-73570-attacks

    Post summary

    The report confirms CVE-2024-45519 is being actively exploited in the wild, with attackers gaining remote code execution and moving laterally across more than 270 Zimbra servers, while runtime segmentation is cited as a containment measure.

    0000079
    1.9K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis reveals attackers exploited CVE-2024-45519 in Zimbra servers through crafted SMTP requests, achieving unauthenticated remote code execution. Following compromise, lateral movement through email infrastructure enabled exfiltration of organizational intelligence including contacts and internal communications. Runtime segmentation could help limit blast radius during such email system compromises. #ZeroTrust #ThreatIntel 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/zimbra-cve-2026-73570-remote-code-execution-vulnerability

    Post summary

    Zimbra servers were compromised in the wild via CVE-2024-45519, using crafted SMTP requests for unauthenticated remote code execution and then conducting lateral movement to exfiltrate contacts and internal communications.

    0000077
    1.9K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploiting CVE-2024-45519 in Zimbra servers to gain remote code execution, then moving laterally across networks to harvest email data and credentials. Runtime segmentation could help contain post-compromise activity within email infrastructure. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/cisa-zimbra-cve-2026-73570-rce-exploit-august-2026

    Post summary

    The post reports that attackers are actively exploiting CVE‑2024‑45519 for remote code execution on Zimbra servers, highlighting ongoing real‑world attacks.

    0000081
    1.9K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploiting CVE-2024-45519 command injection in Zimbra servers to gain full system control, then moving laterally through networks to exfiltrate email data. Runtime segmentation can help contain post-compromise pivoting from compromised collaboration infrastructure. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/cisa-kev-zimbra-cve-2026-73570-os-command-injection

    Post summary

    Attackers are actively exploiting CVE-2024-45519, a command‑injection flaw in Zimbra, to take full system control and exfiltrate email data.

    0000077
    1.9K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploiting CVE-2024-45519 to gain unauthenticated remote code execution on Zimbra servers, then moving laterally to harvest email data across compromised infrastructure. Runtime segmentation helps contain post-compromise pivoting between email systems and core business networks. #ZeroTrust #ThreatIntel :link: Full breakdown: https://aviatrix.ai/threat-research-center/critical-zimbra-rce-cve-2026-73570-actively-exploited-attacks

    Post summary

    The post confirms that CVE-2024-45519 is being actively exploited in the wild, enabling unauthenticated remote code execution on Zimbra servers and lateral movement to harvest email data.

    0000078
    1.9K followersView on X
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2024-45519: n/a (CVSS: 10.0) - 🔧 Exploit ava... Unauthenticated RCE in Zimbra's postjournal service scores perfect 10.0 CVSS - attackers get command execution with zer... https://zerodaysignal.com/vulnerability/CVE-2024-45519 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    A new high‑impact RCE vulnerability (CVE‑2024‑45519) in Zimbra's postjournal service is disclosed, with an implied availability of exploit code but no detailed exploit or evidence of active use.

    0000082
    132 followersView on X
CPE platform detail91 entries

91 of 91 entries

PartVendorProductVersionTarget SWTarget HW
Appsynacorzimbra_collaboration_suite---
Appsynacorzimbra_collaboration_suite10.1.0--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite8.8.15--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--
Appsynacorzimbra_collaboration_suite9.0.0--

Explore more