When Business Email Compromise Starts Rewriting Reality
Rapid7 and Zimbra research details 50+ Zimbra flaws enabling BEC attacks that impersonate senders, rewrite documents, and manipulate calendars.
Rapid7's collaborative research with Zimbra uncovered over 50 vulnerabilities in Zimbra Collaboration Suite, several allowing sender impersonation without credentials, control of inbox visibility, and alteration of shared documents and calendars. The write-up ties to actively exploited Zimbra bugs including CVE-2024-45519 (postjournal command injection), CVE-2025-27915 (stored XSS via crafted .ICS used against Brazilian military targets), and CVE-2026-73570 (unauthenticated SNMP command injection, KEV-added August 21), with Shadowserver counting 260+ compromised instances. Chaining these flaws lets attackers plant fake documents, fabricate executive emails, and manipulate calendar invites, creating what the author calls 'manufactured enterprise reality'.
- Over 50 Zimbra vulnerabilities found; several enable credential-free sender impersonation
- CVE-2026-73570 unauthenticated command injection added to KEV with three-day federal deadline
- Shadowserver counted 260+ compromised Zimbra instances with exploitation artifacts
- Calendar manipulation and planted documents create multi-channel deception victims trust
- Historical zero-days CVE-2022-27925, CVE-2022-37042, CVE-2023-37580 show sustained targeting
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1566.001 Spearphishing AttachmentT1114.003 Email Forwarding Rule
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-27925 | Authenticated Path Traversal File Upload Leading to RCE in Zimbra Collaboration Suite | 7.2 | 99% | KEVRansomwarePoC | KEV |
| CVE-2022-37042 | Unauthenticated ZIP Path Traversal RCE in Synacor Zimbra Collaboration Suite | 9.8 | 92% | KEVRansomwarePoC | KEV |
| CVE-2023-37580 | Stored Cross-Site Scripting (XSS) in Synacor Zimbra Collaboration Suite (ZCS) | 6.1 | 49% | KEV | KEV |
| CVE-2024-45519 | Unauthenticated Command Execution in Synacor Zimbra Collaboration Suite (ZCS) | 9.8 | 100% | KEVPoC | KEV |
| CVE-2025-27915 | Stored XSS in Zimbra Collaboration Suite Classic Web Client via Malicious ICS Files | 5.4 | 4% | KEVPoC | KEV |
| CVE-2026-73570 | Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite | 8.9 | 77% | KEVPoC ×5 | KEV |
From the original article
4 min read at rapid7.com
Business Email Compromise (BEC) operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets.
By Douglas McKee, Director, Vulnerability Intelligence · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.