CVE-2018-10951

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-10 · updated 2026-06-17

Description

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API.

Affected products

Zimbra Collaboration: from 8.7.0 through 8.7.11; from 8.8.0 before 8.8.8; 8.6.0, 8.6.0-patch1, 8.6.0-patch2, 8.6.0-patch3, 8.6.0-patch4, 8.6.0-patch5 (+6) — fixed in 8.8.8

How to fix

Upgrade to a fixed version: Zimbra Collaboration 8.8.8. Check the vendor advisory for mitigations.

References

https://bugzilla.zimbra.com/show_bug.cgi?id=108894
https://bugzilla.zimbra.com/show_bug.cgi?id=108894

Get alerted when CVE-2018-10951 or the next vulnerability affects your stack