# CVE-2026-115785: Zimbra Collaboration Suite SMTP command injection

Source: https://junglewise.ai/threats/cve-2026-115785-an-smtp-command-injection-vulnerability-in-the-data-source  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-115785 · Severity: medium · CVSS 4.3 · Published 2026-10-23

Zimbra Collaboration Suite is a self-hosted email and collaboration platform used by enterprises. An authenticated user can inject commands into SMTP requests through the data-source testing feature, allowing them to forge emails with arbitrary recipients, headers, and content that appear to come from other users' accounts. This could be used to send phishing emails, malware, or fraudulent messages appearing to come from trusted internal addresses.

Technologies: [Zimbra Collaboration Suite](https://junglewise.ai/threats/technologies/collaboration). Vendors: [Zimbra](https://junglewise.ai/threats/vendors/zimbra).

## Quick answers

**Is CVE-2026-115785 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115785 being exploited in the wild.

**How severe is CVE-2026-115785?** Medium severity, with a CVSS score of 4.3, published 23 October 2026.

**Which products and versions are affected?** Zimbra Collaboration Suite 10.1.16, 10.1.20.

**Is there a fix for CVE-2026-115785?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115785 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-115785?** Check whether you run Zimbra Collaboration Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SMTP command injection vulnerability exists in ZCS's data-source testing functionality where CR/LF characters can be injected into the emailAddress field of an SMTP envelope command via JSON SOAP request. An authenticated user with account options enabled can craft a malicious request that, after a successful preliminary POP3 or IMAP login, causes Zimbra to send attacker-controlled commands to the SMTP service; if the service accepts pipelined transactions, arbitrary mail submission is possible without victim interaction.

## Affected products

- Zimbra Collaboration Suite 10.1.16, 10.1.20

## Timeline

- 2026-10-23: advisory

## References

- [https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)
- [https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/](https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/)

## Related threats

- [Zimbra Collaboration Suite local privilege escalation in dnscache](https://junglewise.ai/threats/cve-2026-93640-a-local-privilege-escalation-vulnerability-in-the-optional)
- [Zimbra Collaboration Suite authorization bypass in Zimlet configuration](https://junglewise.ai/threats/cve-2026-93639-a-missing-authorization-vulnerability-in-zimbra-collaboration)
- [Zimbra Collaboration Suite reflected cross-site scripting in login](https://junglewise.ai/threats/cve-2026-93638-a-reflected-cross-site-scripting-vulnerability-in-the-login-page)
- [Zimbra Collaboration Suite LDAP filter injection](https://junglewise.ai/threats/cve-2026-93636-an-ldap-filter-injection-vulnerability-in-zimbra-collaboration)
- [Zimbra Collaboration Suite cross-account authorization bypass in FileSharedWithMeRequest](https://junglewise.ai/threats/cve-2026-93634-a-cross-account-authorization-vulnerability-in-zimbra)