The Zimbra Collaboration platform is currently facing active exploitation attempts targeting a critical vulnerability which allows unauthenticated attackers to execute arbitrary commands through a flaw in its postjournal service. Discovered by researcher Alan Li and assigned a CVSS score of 10, the vulnerability, tracked as CVE-2024-45519, was addressed in Zimbra’s September 2024 updates for versions 8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9, and 10.1.1. The attacks began on September 28, 2024, after Project Discovery disclosed technical details and proof-of-concept (PoC) exploit code. Threat actors exploit the flaw by sending spoofed Gmail emails with Base64-encoded commands in the CC fields, which Zimbra servers parse and execute. This approach has been used to deploy web shells on vulnerable servers, allowing further control and execution of commands. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, citing the risk it poses to federal and private systems. CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies remediate the issue by no later than October 24, 2024, and recommends that private organizations apply the patches as well. While the attacks are ongoing, the responsible threat actors remain unidentified. For systems where immediate patching is not feasible, temporarily removing the postjournal service has been suggested to mitigate potential risks. CTIX analysts recommend that affected users follow the guidance in the KEV to prevent exploitation.