Actively Exploited Zimbra CVE-2024-45519 Enables Remote Code Execution

Dutch authorities warned that attackers are actively exploiting CVE-2024-45519 in Zimbra Collaboration. A specially crafted email sent to a vulnerable Zimbra server can trigger arbitrary code execution, allowing an attacker to compromise the mail platform without requiring user interaction.

Successful exploitation can be used to deploy webshells for persistent remote access. Synacor has issued security updates, and organizations should patch affected Zimbra installations immediately, hunt for webshells and other post-exploitation artifacts, and increase monitoring; patching alone will not remove webshells implanted before remediation.