CVE-2024-45519 Synacor Zimbra Collaboration Suite (ZCS) Command Execution

Exploited in the wild Critical 10.0 Published 2 Oct 2024 Updated 3 Feb 2026

Unauthenticated attackers can execute arbitrary commands via the postjournal service in Zimbra Collaboration.

Exploited in the wild: Since 3 Oct 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-45519?

CVE-2024-45519 is a critical command injection vulnerability in Synacor Zimbra Collaboration Suite, published on 2 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

Weakness: CWE-78

Which versions are affected by CVE-2024-45519?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2024-45519?

No fix has been published for CVE-2024-45519 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Oct 2024.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-45519 being exploited?

Yes. Attackers have exploited CVE-2024-45519 in the wild since at least 3 Oct 2024.

Public exploit code: 1 Nuclei template and 4 proofs of concept on GitHub.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as CVE-2025-71275, GHSA-fr4c-ch83-r968.