Zimbra Collaboration Suite (ZCS) Mailboxd Autodiscover XML External Entity (XXE) Injection Vulnerability (CVE-2019-9670)
Executive & SecOps Summary
SECOPS ASSESSMENTSynacor Zimbra Collaboration Suite (ZCS) 8.7.x before 8.7.11p10
Unauthenticated remote attackers can exploit this XML External Entity (XXE) vulnerability to read arbitrary local files, perform SSRF, and achieve Remote Code Execution (RCE)
Immediately upgrade Zimbra Collaboration Suite to version 8.7.11p10 or later, and restrict external access to the Autodiscover servlet endpoint
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
To apply the official security patch, stop the Zimbra services and upgrade the packages using the system package manager.
# Stop Zimbra services and upgrade the store package (RedHat/CentOS example)
su - zimbra -c 'zmcontrol stop'
yum update zimbra-store -y
su - zimbra -c 'zmcontrol start'2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, block external access to the Autodiscover endpoint via the Zimbra Nginx configuration.
# Edit the Zimbra Nginx template file:
# /opt/zimbra/conf/nginx/templates/nginx.conf.web.http.default.template
# Add the following block to deny access to Autodiscover
location ^~ /Autodiscover/ {
deny all;
return 403;
}3. Log Audit & IoC Verification Commands
Use the following commands to check the current Zimbra version and scan the logs for potential XXE exploitation attempts.
# Check the current installed Zimbra version and patch level
su - zimbra -c 'zmcontrol -v'
# Scan mailbox.log for Autodiscover requests containing XML entity definitions
grep -i 'Autodiscover' /opt/zimbra/log/mailbox.log | grep -E 'ENTITY|SYSTEM' || echo 'No obvious XXE attempts found.'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2019-9670) exists in the mailboxd component of Synacor Zimbra Collaboration Suite (ZCS), specifically within the Autodiscover servlet (Autodiscover/Autodiscover.xml). The XML parser fails to properly restrict or disable external entity resolution (XML External Entity, XXE). Consequently, an unauthenticated attacker can send a crafted XML payload to read sensitive local files, such as localconfig.xml which contains the Zimbra LDAP administrator credentials.
2. Exploitation Mechanics & Attack Scenario
An attacker sends an HTTP POST request containing a malicious XML payload to the unauthenticated /Autodiscover/Autodiscover.xml endpoint. The payload defines an external DTD or inline entity pointing to local system resources.
In real-world attack campaigns, this XXE vulnerability is frequently chained with other administrative endpoints (such as ProxyServlet) to perform Server-Side Request Forgery (SSRF) and ultimately achieve full Remote Code Execution (RCE). Due to its high reliability and impact, it is listed in the CISA KEV catalog and actively exploited by threat actors.
3. Infrastructure & Business Impact
Successful exploitation allows complete compromise of the Zimbra mail server. Attackers can gain unauthorized access to all corporate email communications, pivot into the internal network, or deploy ransomware, posing a catastrophic risk to business continuity and data confidentiality.
Official Vendor Advisories & References
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
Frequently Asked SecOps Questions (CVE-2019-9670)
FAQQ1. How critical is CVE-2019-9670 and is it actively exploited in the wild?
CVE-2019-9670 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-9670?
Primary impacted vendors include synacor, zimbra across zimbra_collaboration_suite. Scope summary: Synacor Zimbra Collaboration Suite (ZCS) 8.7.x before 8.7.11p10
Q3. What temporary mitigations or workarounds exist for CVE-2019-9670 before patching?
[Mitigation] Immediately upgrade Zimbra Collaboration Suite to version 8.7.11p10 or later, and restrict external access to the Autodiscover servlet endpoint Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-9670
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (synacor)
View Category →Zimbra Collaboration Suite (ZCS) Remote Code Execution Vulnerability Advisory (CVE-2026-73570, CISA KEV Listed)
[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.