Rapid7 and Zimbra research finds BEC flaws that let attackers rewrite mailboxes

Rapid7 has published findings from collaborative research with Zimbra that uncovered more than 50 vulnerabilities in the Zimbra Collaboration Suite. Several of the flaws allow an attacker to impersonate senders without credentials, control inbox visibility, and alter shared documents and calendars.

The research describes how this shifts business email compromise from data theft towards shaping what employees see. Attackers can leave a fraudulent message in a victim’s Sent Items folder to create conflicting evidence, or quietly change meeting invitations and RSVP statuses.

The work follows a run of Zimbra bugs added to CISA’s Known Exploited Vulnerabilities catalog, including CVE-2024-45519, CVE-2025-27915 and CVE-2026-73570. Rapid7 said further technical detail will follow in later instalments.