# CVE-2016-3414: Zimbra Collaboration denial of service in mailboxd

Source: https://junglewise.ai/threats/cve-2016-3414-zimbra-collaboration-denial-of-service-in-mailboxd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-3414 · Severity: medium · CVSS 6.5 · Published 2017-01-18

A vulnerability in Zimbra Collaboration Suite allows authenticated users to crash the mailbox service. This can lead to a total loss of email availability for users on the affected server, disrupting business communications and operations.

Technologies: [Synacor Zimbra Collaboration Suite](https://junglewise.ai/threats/technologies/zimbra-collaboration-suite), [Zimbra Collaboration Suite](https://junglewise.ai/threats/technologies/collaboration). Vendors: [Synacor](https://junglewise.ai/threats/vendors/synacor), [Zimbra](https://junglewise.ai/threats/vendors/zimbra).

## Quick answers

**Is CVE-2016-3414 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-3414 being exploited in the wild.

**How severe is CVE-2016-3414?** Medium severity, with a CVSS score of 6.5, published 18 January 2017.

**Which products and versions are affected?** Zimbra Collaboration Suite before 8.6.0 Patch 7.

**Is there a fix for CVE-2016-3414?** A patch was published on 2016-06-28: Zimbra Collaboration 8.6.0 Patch 7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-3414 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2016-3414?** Check whether you run Synacor Zimbra Collaboration Suite or Zimbra Collaboration Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This unspecified vulnerability (internally tracked as bug 102029) exists in Zimbra Collaboration Suite versions prior to 8.6.0 Patch 7. The flaw allows a remote authenticated user to trigger a denial of service condition by causing the 'mailboxd' process to shut down. While the exact technical vector is not disclosed in the advisory, it is classified as a P1/blocker bug by the vendor due to its impact on service availability. The issue is resolved in Zimbra Collaboration 8.6.0 Patch 7.

## Affected products

- Zimbra Zimbra Collaboration Suite before 8.6.0 Patch 7

## Timeline

- 2016-06-28: patched: Zimbra Collaboration 8.6.0 Patch 7 released
- 2017-01-18: disclosed: NVD publication date

## References

- [http://www.securityfocus.com/bid/95918](http://www.securityfocus.com/bid/95918)
- [https://forums.zimbra.org/viewtopic.php?f=8&t=59816](https://forums.zimbra.org/viewtopic.php?f=8&t=59816)
- [https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)

## Related threats

- [Zimbra Collaboration Suite local privilege escalation in dnscache](https://junglewise.ai/threats/cve-2026-93640-a-local-privilege-escalation-vulnerability-in-the-optional)
- [Zimbra Collaboration Suite authorization bypass in Zimlet configuration](https://junglewise.ai/threats/cve-2026-93639-a-missing-authorization-vulnerability-in-zimbra-collaboration)
- [Zimbra Collaboration Suite reflected cross-site scripting in login](https://junglewise.ai/threats/cve-2026-93638-a-reflected-cross-site-scripting-vulnerability-in-the-login-page)
- [Zimbra Collaboration Suite LDAP filter injection](https://junglewise.ai/threats/cve-2026-93636-an-ldap-filter-injection-vulnerability-in-zimbra-collaboration)
- [Zimbra Collaboration Suite cross-account authorization bypass in FileSharedWithMeRequest](https://junglewise.ai/threats/cve-2026-93634-a-cross-account-authorization-vulnerability-in-zimbra)