Reported by 7 outlets
When Business Email Compromise Starts Rewriting Reality
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Rapid7's series opener on Zimbra Collaboration Suite counts more than 50 vulnerabilities, and the ones it leads with change what business email compromise means technically: an attacker who can impersonate senders without holding credentials, control what a victim sees in the inbox, and alter shared documents and calendars is not reading the approval chain, that attacker is authoring it. This lands on a platform with a documented exploitation record. CVE-2024-45519, unauthenticated command injection in the postjournal service scored 9.8, was hit in the wild with base64 payloads in CC fields on September 28, 2024 per Proofpoint and reached CISA's KEV catalog five days later. CVE-2025-27915, stored XSS in the Classic Web Client triggered by a crafted .ICS attachment, ran as a zero-day against Brazilian military targets before Zimbra shipped 9.0.0 Patch 44, 10.0.13, and 10.1.5 on January 27, 2025.
The reason this story outranks the day's other vulnerability noise is that email is the system of record for obligations, approvals, and intent in nearly every organization, and these bug classes corrupt the record itself rather than skirting it. A finance team can be defrauded by someone who never observed the approval process, because the process's artifacts can be manufactured. Calendar and Briefcase manipulation adds manufactured context to manufactured correspondence, which is why Rapid7 frames the work as psychological operations and calendar warfare, and it breaks detections built for the classic BEC pattern: forwarding-rule alerts, impossible travel, and phishing lures all assume the attacker reads while the platform writes. The victim pool is broad and precedented. Volexity counted over 1,000 backdoored Zimbra servers worldwide in August 2022 after CVE-2022-27925 was chained with the CVE-2022-37042 authentication bypass, a medium-rated RCE that mass exploitation turned into an unauthenticated breach tool, and Zimbra's advisory table shows this series already shipping as discrete fixes credited to Rapid7's Jonah Burgess: CVE-2026-73571, delegated send impersonation, in 10.1.17, plus CVE-2026-50054, CVE-2026-50055, CVE-2026-10631, and CVE-2026-73570 in 10.1.20. The realistic exposure state for a Zimbra fleet is version drift across that patch ladder, not one missing update.
Defenders should pin each build against the vendor table instead of assuming a single patch covers the series. CVE-2024-45519 is fixed in 9.0.0 Patch 41, 10.0.9, 10.1.1, and 8.8.15 Patch 46, released September 4, 2024. CVE-2025-27915 is fixed in 9.0.0 Patch 44, 10.0.13, and 10.1.5. The 2026 impersonation, delegation, forwarding, and EWS fixes land in 10.1.17 and 10.1.20, and 10.1.20 also covers CVE-2026-73570, command injection in the SNMP monitoring component that applies only when SNMP notifications are enabled. Kudelski Security's advisory offers restricting or disabling the postjournal service as a bridge while unpatched. Hunt on the known signatures rather than trusting patch state: proxy and mailbox logs for POSTs to /service/extension/backup/mboximport returning 401, the 2022 mass-exploitation marker Volexity documented; unexpected JSP files under /opt/zimbra; the message store for Base64-encoded .ICS entries, guidance Zimbra itself gave after the Brazilian military campaign, whose payload added a mail filter named Correo forwarding to a Proton address and pulled mail through the Zimbra SOAP API every four hours; and every forwarding rule and delegation grant, since CVE-2026-50055 is precisely a forwarding-restriction bypass. StrikeReady caught the .ICS zero-day by flagging attachments over 10KB containing JavaScript, a static rule cheap to add upstream, and admin and webmail interfaces belong off the internet throughout.
Two developments would change the assessment. The next installments of the Rapid7 series will show whether these bugs chain, and chaining is what history says to expect: CVE-2022-27925 plus CVE-2022-37042 turned a medium RCE needing admin credentials into unauthenticated mass exploitation within weeks in 2022. And watch CISA's KEV and public exploit repositories for the new identifiers, because Zimbra's postjournal bug went from Proofpoint telemetry to KEV in five days in 2024; the same cadence for CVE-2026-73571 or CVE-2026-50055 would convert a research story into an emergency patch cycle for every exposed Zimbra instance.
Timeline
-
original reporting
When Business Email Compromise Starts Rewriting Reality
rapid7.com · 19d ago · September 24th, 2026
Business Email Compromise (BEC) operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series around Rapid7's collaborative research with Zimbra; upcoming installments will explore technical details and broader findings based within the Zimbra Collaboration Suite. Our investigation disrupted the traditional BEC model in unexpected ways. We uncovered over 50 vulnerabilities, and found that several allow attackers not just to observe environments, but to actively rewrite them by impersonating senders without credentials, controlling inbox visibility, and altering shared documents and calendars. Business Email Compromise in action: Digital abuse of trust None of this is theoretical for Zimbra. But don’t take my word for it, just ask Russia . CISA keeps putting Zimbra bugs into the Known Exploited Vulnerabilities catalog , and the last three years make the point on their own: CVE-2024-45519 , command injection in the postjournal service, unauthenticated command execution. Proofpoint saw attackers stuffing base64 payloads into CC fields on September 28, 2024. CISA added it to KEV on October 3. CVE-2025-27915 , stored XSS in the Classic Web Client, triggered by a crafted .ICS attachment. It is used as a zero-day against Brazilian military targets to steal mail and quietly set forwardin
-
update from volexity.com
Mass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925
volexity.com · 1526d ago · August 10th, 2022
Volexity reported mass exploitation of CVE-2022-27925, an mboximport RCE in Zimbra Collaboration Suite, enabled as unauthenticated by the CVE-2022-37042 authentication bypass, with evidence of attacks as early as the end of June 2022. Internet-wide scanning identified over 1,000 backdoored ZCS instances worldwide, including government departments, ministries, and military branches. The post documents POST requests to /service/extension/backup/mboximport returning 401 as an exploitation signature, provides YARA rules for the deployed webshells, and lists patches 8.8.15P31/P33 and 9.0.0P24/P26.
-
update from cisa.gov
Russian State-Sponsored Actors Exploiting Zimbra... (AA22-228A)
cisa.gov · 1520d ago · August 16th, 2022
Joint CISA and MS-ISAC advisory, initial version August 16, 2022, responding to active exploitation of multiple ZCS vulnerabilities: CVE-2022-24682, CVE-2022-27924, CVE-2022-27925 chained with CVE-2022-37042, and CVE-2022-30333. It warns that unpatched or internet-exposed ZCS instances in government and private sector networks should be assumed compromised and provides Snort signatures, IOCs, and detection guidance for hunting.
-
update from wiki.zimbra.com
Zimbra Collaboration Kepler 9.0.0 Patch 41 GA Release
wiki.zimbra.com · 770d ago · September 4th, 2024
Vendor patch release dated September 4, 2024 fixing CVE-2024-45519, a vulnerability in the postjournal service that may allow unauthenticated users to execute commands, rated CVSS 9.8. Zimbra's security advisories table maps the same fix to 10.0.9, 10.1.1, and 8.8.15 Patch 46, crediting researcher lebr0nli (Alan Li).
-
update from kudelskisecurity.com
Security vulnerability discovered in the postjournal service of Zimbra Collaboration Suite
kudelskisecurity.com · 742d ago · October 2nd, 2024
Kudelski Security's advisory for CVE-2024-45519 describes an unauthenticated RCE in the postjournal email processing module, exploitable by sending a specially crafted email to a vulnerable server, affecting 8.8.15 up to Patch 45 and 9.0.0 up to Patch 40. It recommends updating to 8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9, or 10.1.1, restricting or disabling the postjournal service as a workaround, and monitoring system logs for suspicious postjournal activity.
-
update from securityweek.com
Critical Zimbra Vulnerability Exploited One Day After PoC Release
securityweek.com · 742d ago · October 2nd, 2024
Early exploitation coverage reporting that CVE-2024-45519, a critical-severity vulnerability in Zimbra, was exploited in the wild to deploy a web shell on vulnerable servers one day after a public proof-of-concept appeared.
-
update from bleepingcomputer.com
Hackers exploited Zimbra flaw as zero-day using iCalendar files
bleepingcomputer.com · 373d ago · October 5th, 2025
Bill Toulas reports StrikeReady research showing CVE-2025-27915 was exploited as a zero-day starting at the beginning of January 2025, before Zimbra shipped 9.0.0 Patch 44, 10.0.13, and 10.1.5 on January 27, 2025 without mentioning exploitation. The attack spoofed the Libyan Navy's Office of Protocol to hit a Brazilian military organization with a Base64-obfuscated JavaScript payload in an oversized .ICS attachment that stole credentials, email, and contacts, added a mail filter named Correo forwarding to a Proton address, and exfiltrated through the Zimbra SOAP API every four hours. TTP overlap with UNC1151 is noted, and Zimbra told the outlet the activity did not appear widespread.
-
update from www.rapid7.com
(rapid7.com) Business Email Compromise Reimagined: How Zimbra Vulnerabilities Enable Psychological Operations and Calendar Warfare In brief
www.rapid7.com · 19d ago · September 24th, 2026
(rapid7.com) Business Email Compromise Reimagined: How Zimbra Vulnerabilities Enable Psychological Operations and Calendar Warfare In brief
via Mastodon https://www.rapid7.com/blog/post/ve-business-email-compromise-rewriting-reality-zimbra-cve