{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-115785","assignerOrgId":"9974b330-7714-4307-a722-5648477acda7","state":"PUBLISHED","assignerShortName":"rapid7","dateReserved":"2026-10-23T13:40:41.297Z","datePublished":"2026-10-23T13:50:33.115Z","dateUpdated":"2026-10-29T10:45:48.181Z"},"containers":{"cna":{"providerMetadata":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-23T13:50:33.115Z"},"title":"Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address","datePublic":"2026-10-23T13:47:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-93","description":"CWE-93 Improper neutralization of CRLF sequences ('CRLF injection')","type":"CWE"}]}],"affected":[{"vendor":"Zimbra","product":"Zimbra Collaboration Suite","versions":[{"status":"affected","version":"0","lessThanOrEqual":"10.1.20","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.","supportingMedia":[{"type":"text/html","base64":false,"value":"An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20."}]}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["vendor-advisory"]},{"url":"https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/","tags":["related"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}],"credits":[{"lang":"en","value":"Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115785","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-24T03:55:31.920337Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-29T10:45:48.181Z"}}]}}