# CVE-2016-3415: Zimbra Collaboration deserialization attack via unspecified vectors

Source: https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-3415 · Severity: critical · CVSS 9.1 · Published 2017-01-18

Zimbra Collaboration, a widely used enterprise email and collaboration platform, is vulnerable to a security flaw that allows remote attackers to execute unauthorized commands. By exploiting how the system processes data, an attacker could potentially gain full control over the server, leading to the theft of sensitive emails, data breaches, or disruption of business communications. Organizations using versions older than 8.7.0 should upgrade immediately to protect their infrastructure.

Technologies: [Synacor Zimbra Collaboration Suite](https://junglewise.ai/threats/technologies/zimbra-collaboration-suite), [Zimbra Collaboration](https://junglewise.ai/threats/technologies/collaboration). Vendors: [Synacor](https://junglewise.ai/threats/vendors/synacor), [Zimbra](https://junglewise.ai/threats/vendors/zimbra).

## Quick answers

**Is CVE-2016-3415 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-3415 being exploited in the wild.

**How severe is CVE-2016-3415?** Critical severity, with a CVSS score of 9.1, published 18 January 2017.

**Which products and versions are affected?** Zimbra Collaboration before 8.7.0.

**Is there a fix for CVE-2016-3415?** A patch was published on 2016-07-01: Fixed in Zimbra Collaboration 8.7.0 GA release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-3415 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-3415?** Check whether you run Synacor Zimbra Collaboration Suite or Zimbra Collaboration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Zimbra Collaboration (ZCS) versions prior to 8.7.0 are vulnerable to an untrusted data deserialization flaw (CWE-502). The vulnerability exists in unspecified vectors within the application's handling of serialized objects. A remote, unauthenticated attacker can exploit this by sending specially crafted data to the server, which, when processed, can lead to arbitrary code execution or unauthorized access to sensitive information. The issue is tracked internally by Zimbra as bug 102276 and was addressed in the 8.7.0 General Availability release.

## Affected products

- Zimbra Zimbra Collaboration before 8.7.0

## Timeline

- 2016-07-01: patched: Fixed in Zimbra Collaboration 8.7.0 GA release
- 2017-01-18: disclosed: NVD publication date

## References

- [http://www.securityfocus.com/bid/95917](http://www.securityfocus.com/bid/95917)
- [https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.0](https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.0)
- [https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)

## Related threats

- [Zimbra Collaboration stored XSS in share notifications](https://junglewise.ai/threats/cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that)
- [Zimbra Collaboration stored XSS in share notifications](https://junglewise.ai/threats/cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that)
- [Synacor Zimbra Collaboration Suite XSS in Classic UI](https://junglewise.ai/threats/cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui)
- [Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet](https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet)
- [Synacor Zimbra Collaboration Suite stored XSS in Classic UI](https://junglewise.ai/threats/cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui)