{"id":"CVE-2024-45519","published":"2024-10-02T22:15:02Z","modified":"2026-06-17T07:54:22Z","title":"Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability","vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","tier":"core","eol":null,"description":{"text":"The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.","provenance":"source","from":"NVD"},"summary":{"text":"The postjournal service in Synacor's Zimbra Collaboration Suite (ZCS) contains a flaw that can allow command execution, tied to improper neutralization of OS command elements and improper access control. An unauthenticated attacker with network access can trigger it without any user interaction or special configuration, since the vulnerable condition is reachable without credentials.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:53Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99907,"percentile":0.99967,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-10-03","dueDate":"2024-10-24","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2024-45519","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-10-01","exploitedFirstSeen":"2024-10-01","ransomware":false,"evidence":[{"url":"https://x.com/JusticeRage/status/1841017884245438555","date":"2024-10-01"},{"url":"https://x.com/threatinsight/status/1841089939905134793","date":"2024-10-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-10-03"},{"url":"https://www.fortiguard.com/outbreak-alert/zimbra-collaboration-rce","date":"2024-10-09"},{"url":"https://cert.pl/uploads/docs/Report_CP_2024.pdf","date":"2025-04-03"},{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy","tags":["Not Applicable"]},{"url":"https://blog.projectdiscovery.io/zimbra-remote-code-execution/","tags":["Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45519","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploitation of public-facing mail service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"sometimes allows unauthenticated users to execute commands","start":144,"end":202}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: command execution via OS command injection","mappingType":"primary_impact","evidence":[{"from":"description","quote":"sometimes allows unauthenticated users to execute commands","start":144,"end":202}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-41520","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41520","exploited":true,"exploitedSince":"2024-10-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2024-09-28","earliestUrl":"https://github.com/p33d/CVE-2024-45519","repos":[{"name":"Chocapikk/CVE-2024-45519","url":"https://github.com/Chocapikk/CVE-2024-45519","stars":140,"created":"2024-10-05"},{"name":"p33d/CVE-2024-45519","url":"https://github.com/p33d/CVE-2024-45519","stars":42,"created":"2024-09-28"},{"name":"sec13b/CVE-2024-45519","url":"https://github.com/sec13b/CVE-2024-45519","stars":0,"created":"2025-03-08"},{"name":"lionels-cyber/CVE-2024-45519-Zimbra-Real-Fix","url":"https://github.com/lionels-cyber/CVE-2024-45519-Zimbra-Real-Fix","stars":0,"created":"2026-08-15"}]},"nuclei":[{"id":"CVE-2024-45519","name":"Zimbra Collaboration Suite < 9.0.0 - Remote Code Execution","severity":"critical","path":"javascript/cves/2024/CVE-2024-45519.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-45519.yaml"}],"first":{"date":"2024-09-28","source":"PoC-in-GitHub","url":"https://github.com/p33d/CVE-2024-45519"},"provenance":"source"},"exploitRefs":["https://blog.projectdiscovery.io/zimbra-remote-code-execution/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2024-09-28","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/p33d/CVE-2024-45519","provenance":"source"},{"date":"2024-10-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://x.com/JusticeRage/status/1841017884245438555","provenance":"source"},{"date":"2024-10-02","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45519","provenance":"source"},{"date":"2024-10-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-10-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41520","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 759 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 4 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}