# CVE-2016-3401: Zimbra Collaboration integrity vulnerability via unknown vectors

Source: https://junglewise.ai/threats/cve-2016-3401-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-3401 · Severity: medium · CVSS 6.5 · Published 2017-01-18

Zimbra Collaboration is an enterprise-grade email and collaboration platform. A vulnerability in versions prior to 8.7.0 allows authenticated users to perform unauthorized actions that compromise the integrity of the system. This could lead to the modification of data or settings by individuals who already have access to the platform.

Technologies: [Synacor Zimbra Collaboration Suite](https://junglewise.ai/threats/technologies/zimbra-collaboration-suite), [Zimbra Collaboration](https://junglewise.ai/threats/technologies/collaboration). Vendors: [Synacor](https://junglewise.ai/threats/vendors/synacor), [Zimbra](https://junglewise.ai/threats/vendors/zimbra).

## Quick answers

**Is CVE-2016-3401 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-3401 being exploited in the wild.

**How severe is CVE-2016-3401?** Medium severity, with a CVSS score of 6.5, published 18 January 2017.

**Which products and versions are affected?** Zimbra Collaboration before 8.7.0.

**Is there a fix for CVE-2016-3401?** A patch was published on 2016-07-01: Fixed in Zimbra Collaboration 8.7.0 GA release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-3401 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-3401?** Check whether you run Synacor Zimbra Collaboration Suite or Zimbra Collaboration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an unspecified vulnerability (CWE-noinfo) in Zimbra Collaboration versions prior to 8.7.0. The flaw allows a remote attacker with valid authentication credentials to impact the integrity of the system. While the specific root cause and vulnerable component are not publicly detailed (referenced internally as bug 99810), the attack vector is network-based and does not require user interaction. The vulnerability was addressed in the Zimbra Collaboration 8.7.0 GA release. Security engineers should ensure their Zimbra instances are upgraded to version 8.7.0 or later to mitigate this risk.

## Affected products

- Zimbra Zimbra Collaboration before 8.7.0

## Timeline

- 2016-07-01: patched: Fixed in Zimbra Collaboration 8.7.0 GA release
- 2017-01-18: disclosed: NVD publication date

## References

- [http://www.securityfocus.com/bid/95860](http://www.securityfocus.com/bid/95860)
- [https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.0](https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.0)
- [https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)

## Related threats

- [Zimbra Collaboration stored XSS in share notifications](https://junglewise.ai/threats/cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that)
- [Zimbra Collaboration stored XSS in share notifications](https://junglewise.ai/threats/cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that)
- [Synacor Zimbra Collaboration Suite XSS in Classic UI](https://junglewise.ai/threats/cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui)
- [Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet](https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet)
- [Synacor Zimbra Collaboration Suite stored XSS in Classic UI](https://junglewise.ai/threats/cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui)