# CVE-2016-3404: Zimbra Collaboration integrity vulnerability via unknown vectors

Source: https://junglewise.ai/threats/cve-2016-3404-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-3404 · Severity: high · CVSS 7.5 · Published 2017-01-18

A vulnerability in Zimbra Collaboration versions prior to 8.7.0 allows remote attackers to compromise the integrity of the system. This could potentially allow unauthorized modifications to email data or system configurations, impacting the reliability of the communication platform. Organizations using affected versions should upgrade to version 8.7.0 or later to ensure the security of their messaging environment.

Technologies: [Synacor Zimbra Collaboration Suite](https://junglewise.ai/threats/technologies/zimbra-collaboration-suite), [Zimbra Collaboration](https://junglewise.ai/threats/technologies/collaboration). Vendors: [Synacor](https://junglewise.ai/threats/vendors/synacor), [Zimbra](https://junglewise.ai/threats/vendors/zimbra).

## Quick answers

**Is CVE-2016-3404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-3404 being exploited in the wild.

**How severe is CVE-2016-3404?** High severity, with a CVSS score of 7.5, published 18 January 2017.

**Which products and versions are affected?** Zimbra Collaboration before 8.7.0.

**Is there a fix for CVE-2016-3404?** A patch was published on 2016-07-13: Release date of Zimbra 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-3404 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-3404?** Check whether you run Synacor Zimbra Collaboration Suite or Zimbra Collaboration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unspecified vulnerability in Zimbra Collaboration (formerly Zimbra Collaboration Suite) before version 8.7.0 allows remote attackers to affect system integrity. The vulnerability is tracked internally by the vendor as bug 103959. While specific technical details regarding the root cause or vulnerable component are not publicly disclosed, the CVSS 3.0 vector indicates a network-based attack vector with low complexity and no required user interaction or privileges. Successful exploitation allows an attacker to perform high-impact integrity violations. The issue is resolved in Zimbra Collaboration 8.7.0.

## Affected products

- Zimbra Zimbra Collaboration before 8.7.0

## Timeline

- 2017-01-18: advisory: NVD publication date
- 2016-07-13: patched: Release date of Zimbra 8.7.0

## References

- [http://www.securityfocus.com/bid/95894](http://www.securityfocus.com/bid/95894)
- [https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.0](https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.0)
- [https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)

## Related threats

- [Zimbra Collaboration stored XSS in share notifications](https://junglewise.ai/threats/cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that)
- [Zimbra Collaboration stored XSS in share notifications](https://junglewise.ai/threats/cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that)
- [Synacor Zimbra Collaboration Suite XSS in Classic UI](https://junglewise.ai/threats/cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui)
- [Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet](https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet)
- [Synacor Zimbra Collaboration Suite stored XSS in Classic UI](https://junglewise.ai/threats/cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui)