A remote code execution vulnerability in Zimbra Collaboration allows unauthenticated attackers to gain full system control.

The software fails to properly neutralize special elements used in OS commands (CWE-78), allowing for OS command injection. This vulnerability is remotely exploitable without the need for authentication.

Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the Zimbra service, likely leading to total system compromise and data exfiltration. The CVSS score of 8.9 highlights the critical nature of this vulnerability for internet-facing mail servers.

Immediate Action: Update Zimbra Collaboration to version 10.1.20 or later immediately.

Proactive Monitoring: Inspect server logs for unusual command execution patterns or unauthorized files created within the web application directory.

Compensating Controls: Ensure the Zimbra server is behind a robust firewall and use a WAF to filter malicious traffic that attempts to inject OS commands.

Public Exploit Available: No (exploit_available: false)

Due to the remote and unauthenticated nature of this vulnerability, immediate patching is required. Organizations should treat this as a critical priority, especially for ZCS instances exposed to the public internet.