A critical authentication bypass vulnerability in Zimbra Collaboration (ZCS) allows authenticated users to circumvent 2FA protections, potentially leading to unauthorized account access.

The flaw resides within the EnableTwoFactorAuthRequest SOAP endpoint. Contrary to the description, the CVSS vector (AV:N/AC:L/PR:N/UI:N) suggests the endpoint is accessible without authentication, allowing an attacker to manipulate 2FA settings for existing accounts.

Successful exploitation allows an attacker to disable or bypass 2FA, effectively neutralizing a primary layer of identity security. Given the 9.1 CVSS score, this represents a Critical risk; unauthorized access to collaborative environments often results in sensitive data exfiltration, business email compromise (BEC), and potential lateral movement within the corporate network.

Immediate Action: Consult the official Zimbra Security Center to identify the specific patched version and apply the update immediately.

Proactive Monitoring: Review ZCS access logs for unusual patterns of SOAP requests, specifically those targeting the EnableTwoFactorAuthRequest endpoint.

Compensating Controls: Ensure that any administrative access to the ZCS SOAP API is restricted via network-level controls or a Web Application Firewall (WAF) to limit exposure.

Public Exploit Available: Unknown

This vulnerability presents a severe risk to organizational identity integrity. Administrators must prioritize checking the Zimbra Security Advisories page for the latest patch release and deploy it across all ZCS instances as a matter of high urgency.