CVE-2024-45519

Zimbra Collaboration's postjournal service, which handles journaling of email, fails to properly sanitize input before it reaches a system command, so an unauthenticated attacker can inject operating-system commands that execute on the mail server. The trigger is reachable by sending crafted SMTP traffic, meaning an attacker who can deliver mail to a vulnerable server can, under the right conditions, run commands on it without any credentials or interaction.

Zimbra is a widely deployed open-source email and collaboration platform, and mail servers are internet-facing by necessity, which puts a large exposed population directly within reach. Zimbra has a long track record of being targeted, and this flaw was exploited in the wild almost immediately after disclosure, with mass-exploitation attempts observed dropping web shells within days of the patch. Update to the fixed builds (8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9, or 10.1.1) without delay, and where postjournal is not required, confirm it is disabled. Because exploitation began so quickly, treat exposed servers as possibly already compromised and hunt for planted web shells and anomalous outbound activity rather than relying on the patch alone.