SMTP Command Injection Vulnerability in Zimbra Collaboration Suite

CVE-2026-115785

What is CVE-2026-115785?

An SMTP command injection vulnerability exists in the Zimbra Collaboration Suite's data-source testing functionality. This flaw permits an authenticated user with specific account options enabled to manipulate SMTP envelope commands via JSON SOAP requests. Upon logging in through POP3 or IMAP, the affected versions of ZCS send the injected commands to the invoked SMTP service. If the SMTP service processes these commands as part of a pipelined transaction, the attacker gains the ability to send emails with specified recipients, headers, and body content without the victim's consent, potentially facilitating malicious activities.

References