CVE-2019-9670: Zimbra mailboxd Autodiscover XXE allows unauthenticated compromise

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network XXE with public exploit code, KEV listing and near-maximum EPSS on a mail server makes this an urgent patch.

What it is

The mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 parses XML in the Autodiscover servlet without restricting external entities, creating an XXE flaw. Because the endpoint is network-reachable and needs no credentials, it exposes mail infrastructure to direct compromise.

Impact

An attacker can read local files and server-side resources through crafted XML, and public exploit chains use the XXE to reach remote code execution on the Zimbra host. That yields full control of the mail server and the data it holds.

Attack surface

Reached over the network via the Autodiscover/Autodiscover.xml endpoint; the CVSS vector shows no privileges and no user interaction required. Any host that can reach the Zimbra web interface can attempt it.

Exploitation

CISA added it to KEV on 2022-01-10 with a 2022-07-10 remediation due date, and EPSS is 0.99986 (99.983rd percentile). Multiple references are tagged Exploit, including Packet Storm, Exploit-DB and a Rapid7 Metasploit module.

What to do

• Upgrade Zimbra Collaboration Suite to 8.7.11p10 or later, or the current supported release.
• If patching cannot be immediate, restrict network access to the Autodiscover endpoint to trusted clients only.
• Disable or block external entity resolution in the XML parser configuration where the product allows it.
• Treat any unpatched, internet-facing Zimbra 8.7.x host as compromised and hunt for post-exploitation activity.

Detection

• Monitor web logs for POST requests to /Autodiscover/Autodiscover.xml with XML bodies containing DOCTYPE or ENTITY declarations.
• Alert on outbound connections from the Zimbra host to unexpected external hosts, which can indicate XXE data exfiltration.
• Look for unexpected child processes or web shells spawned by the mailboxd service.
• Review file access and authentication logs on the Zimbra server for reads of sensitive local files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.