CVE-2024-45519: Zimbra Collaboration postjournal service unauthenticated command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a CVSS of 9.8, confirmed exploitation in CISA KEV, and near-certain EPSS probability make this an urgent patch-first issue.

What it is

The postjournal service in Zimbra Collaboration Suite fails to properly neutralize input, allowing OS command injection. Because the service can be reached without authentication, an attacker can run arbitrary commands on the mail server. The flaw affects ZCS before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1.

Impact

An unauthenticated attacker can execute arbitrary operating system commands on the Zimbra server, leading to full compromise of the mail infrastructure and any data or credentials it holds. This can result in data theft, mail interception, and use of the host as a foothold for further attacks.

Attack surface

The vulnerability is network-reachable through the postjournal service and requires no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed or internally reachable Zimbra instance running an affected version is a candidate target.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2024-10-03, and EPSS gives a 30-day exploitation probability of 0.99907 (99.9th percentile). A public exploit write-up is referenced, so active exploitation should be assumed.

What to do

• Apply the vendor patches immediately: ZCS 8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9, or 10.1.1 as applicable.
• If patching cannot be done at once, restrict network access to the postjournal service and the Zimbra admin/mail ports to trusted sources only.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.
• Review Zimbra server logs and process execution for signs of compromise before and after patching, and rotate credentials if compromise is suspected.
• Confirm no unauthorized changes to mail routing, filters, or admin accounts after remediation.

Detection

• Monitor Zimbra postjournal service logs and system process creation for unexpected child processes or shell commands spawned by the mail service.
• Alert on network connections to the postjournal service from untrusted or external sources.
• Hunt for command-injection patterns in requests reaching the postjournal service, such as shell metacharacters in submitted fields.
• Correlate Zimbra host activity with outbound connections or new scheduled tasks that could indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.