Loading story…
InfoGuard Labs disclosed 22 vulnerabilities in Tobit.Software's TeamDavid collaboration and messaging platform, a product marketed as a secure Microsoft 365 alternative and reportedly exposed on about 12,000 internet-accessible instances. The findings span two disclosure rounds and include unauthenticated denial of service, memory disclosure, buffer overflows, open redirect, HTTP header injection, SSRF via UNC paths, path traversal, arbitrary file deletion and write, stored XSS, and missing authorization. Researchers said the most serious attack chain abused a heap memory leak in the unauthenticated /.well-known/mta-sts. endpoint together with reversibly stored passwords in access.ini files, allowing attackers to recover credentials and access user mailboxes without prior authentication.
One of the newly tracked flaws, CVE-2026-54200, affects TeamDavid Webbox through Rollout 524 and allows authenticated local file inclusion through the scjob form field in email, fax, and SMS functions. By using the @@attach mechanism and bypassing folder protections with alternate data streams, an attacker can attach and retrieve arbitrary files, including other users' access files containing passwords and the server's private key. InfoGuard said Tobit was notified in December, reported partial fixes in late January, and a retest found some remediations were incomplete while uncovering nine additional issues, leaving organizations running TeamDavid at risk of mailbox compromise, sensitive file exposure, forced SMB authentication, server crashes, and possible escalation toward full system compromise.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
InfoGuard Labs publicly disclosed 22 vulnerabilities in TeamDavid, including issues that could enable mailbox compromise, denial of service, file access, SSRF, and potential escalation toward full system compromise.
A CVE entry was published for CVE-2026-54200, a high-severity local file inclusion flaw in TeamDavid Webbox through Rollout 524 that lets an authenticated user abuse the scjob field and @@attach command to access arbitrary files.
According to the researchers, Tobit.Software reported partial fixes by late January following the initial disclosure round.
InfoGuard Labs said it notified the vendor in December after identifying vulnerabilities in TeamDavid during an external penetration test and manual analysis.
A follow-up assessment found some remediations were incomplete and uncovered nine additional vulnerabilities, contributing to a total of 22 reported issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple severe vulnerabilities in **SmarterMail** exposed internet-facing mail servers to compromise, including `CVE-2025-52691`, an unauthenticated arbitrary file upload flaw that can lead to immediate remote code execution, and `CVE-2026-23760`, an authentication bypass tied to the password reset API. Public reporting said `CVE-2025-52691` affected **Build 9406 and earlier**, carried a **CVSS 10.0** rating, and allowed attackers with network access to place files in arbitrary server locations and execute code with the privileges of the SmarterMail service. Advisories from Censys highlighted both issues, while a public GitHub proof-of-concept for `CVE-2026-23760` increased the risk of opportunistic exploitation. SmarterTools reportedly fixed the file upload vulnerability in **Build 9413**, with later builds available afterward, and security reporting warned that successful compromise of a mail gateway could expose customer email, credentials, and connected backend systems. The flaws were described as especially dangerous for hosting providers and organizations running exposed SmarterMail instances because they enable unauthenticated access paths that can quickly escalate to full server compromise.
Jun 29, 2026
Zimbra disclosed security updates for Zimbra Collaboration Suite (ZCS) Daffodil releases before `10.1.21`, addressing vulnerabilities that include **CVE-2026-93643**, a critical unauthenticated path-traversal flaw in the OnlyOffice/Document Editing integration. An attacker able to access an existing supported public Briefcase document can abuse unsigned save fields in a `/downloadas` request to write files through path traversal and execute commands as the `zimbra` user; the flaw is rated CVSS 9.8. Canadian and Guyanese national cyber authorities urged administrators to review Zimbra’s release information and apply the available update. Two additional unauthenticated stored XSS vulnerabilities, **CVE-2026-93642** and **CVE-2026-93647**, can let attackers execute script in authenticated users’ browsers and access mailbox data or act as those users. The first uses a forged share invitation accepted in Zimbra Modern, while the second embeds active markup in the `From` field of a calendar `COUNTER` message viewed in the Classic client. Rapid7 warned that weaknesses across Zimbra mail, document, and calendar functions can support business email compromise campaigns that manipulate the records employees use for decisions, creating coordinated fraudulent communications and complicating forensic investigation.
Sep 29, 2026
TeamViewer has released fixes for two high-severity Desktop Client vulnerabilities: `CVE-2026-19042`, a Linux command-injection issue, and `CVE-2026-16444`, an improper path-validation flaw. `CVE-2026-19042` can enable remote code execution after a Linux user clicks an attacker-crafted URL sent through out-of-session chat. `CVE-2026-16444` allows an authenticated participant in a remote session to use path-traversal sequences in file-transfer or virtual-file-clipboard filenames to write files outside the intended download directory. The arbitrary file-write flaw could allow attackers to place or overwrite executables, scripts, shortcuts, or configuration files and potentially execute code with the affected user's privileges. Affected deployments include TeamViewer Remote, Tensor, and ONE using vulnerable Full Client, Host, or QuickSupport components on Windows, macOS, and Linux. Organizations should update clients to version `15.81.5` or later, apply the available legacy-branch fixes, and instruct Linux users awaiting patches not to open links received through TeamViewer chat; TeamViewer reported no known public disclosure or in-the-wild exploitation before its advisory.
Aug 28, 2026