Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3

Summary

Zimbra Collaboration Suite, an email and collaboration platform, is affected. An attacker could abuse its ProxyServlet component to make the server send requests to internal or otherwise unintended destinations, potentially exposing internal resources.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Apr 30, 2019, 5:40 PM UTCCVE published
2. Jul 7, 2025Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. Jul 28, 2025CISA remediation deadline

   Due date for US federal agencies to patch

4. Oct 21, 2025, 11:45 PM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

References 9