CVE-2024-45519

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.999 · 100 %ileexploit · PoCEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 4 exploits · PoC

Likely / severe?

99.9% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

12 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · ncsc_nl

added 2024-10-03remediate by 2024-10-24

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-22

Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:Nsecondary · ENISA EU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · cve@mitre.org USexploitability 3.9 · impact 6

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.110criticalCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USCWE-78USCWE-78US

exploits (4)

Public proof-of-concept and weaponised exploit code.

Chocapikk/CVE-2024-45519Zimbra - Remote Command Execution (CVE-2024-45519)PoC · poc_in_github
lionels-cyber/CVE-2024-45519-Zimbra-Real-FixZimbra CVE-2024-45519 real fix - Official patch is incompletePoC · poc_in_github
p33d/CVE-2024-45519p33d/CVE-2024-45519PoC · poc_in_github
sec13b/CVE-2024-45519Zimbra CVE-2024-45519PoC · poc_in_github

affected products (12)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
Zimbra Inc. Zimbra Collaboration Suite10.0.0 → 10.0.9fstec_bduRU
Zimbra Inc. Zimbra Collaboration Suite10.1.0 → 10.1.1fstec_bduRU
Zimbra Inc. Zimbra Collaboration Suite8.8.15 → 8.8.15 Patch 46 GA (Joule)fstec_bduRU
Zimbra Inc. Zimbra Collaboration Suite9.0.0 → 9.0.0 Patch 41 GA (Kepler)fstec_bduRU
synacor zimbra collaboration serverall versionsncsc_nlNLcpe:2.3:a:synacor:zimbra_collaboration_server:*:*:*:*:*:*:*:*
synacor zimbra collaboration suiteall versionsncsc_nlNLcpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
synacor zimbra collaboration suite< 8.8.15nvdUScpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
synacor zimbra collaboration suite10.0.0 → 10.0.9nvdUScpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
synacor zimbra collaboration suite= 10.1.0nvdUScpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
synacor zimbra collaboration suite= 8.8.15nvdUScpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
synacor zimbra collaboration suite= 9.0.0nvdUScpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

NCSC-2024-0386Kwetsbaarheden verholpen in ZimbraNL2024-10-02csaf · ncsc_nlNL
Synacor heeft kwetsbaarheden verholpen in Zimbra Collaboration.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu ncsc_nl nvd NVD CVE.org MITRE

published 2024-10-02modified 2026-06-17

references (22)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan