The Zimbra Collaboration Suite version 8.8.15 contains a command injection flaw that allows attackers to execute arbitrary system commands without authentication. The vulnerability is tied to improper sanitization of the RCPT TO parameter during SMTP transactions, enabling shell expansion syntax to be injected. The weakness corresponds to CWE‑78, which signifies a system command execution vulnerability. Under the Zimbra service context the attacker can run arbitrary code, potentially granting full control over the affected system.

The vulnerable component is the PostJournal service of Zimbra Collaboration Suite. Only the 8.8.15 release is listed as affected. Administrators should review any installations of ZCS that include this service version and verify whether the patch level is up to date.

The vulnerability scores a CVSS base of 9.3, indicating critical risk. No EPSS score is available, but the flaw allows unauthenticated remote code execution through SMTP, making it highly likely to be abused if an attacker can reach the server. Because it is not listed in CISA’s KEV catalog, active exploitation may not yet be widespread, yet the lack of authentication requirement gives an attacker a very low barrier to exploitation. The attack vector is the SMTP interface; an attacker only needs to send a crafted RCPT TO command, which the service does not properly validate.