DEV Community

StarkMan
StarkMan

Posted on

Why "Zimbra Web Client" Appears Half a Million Times and Almost None of It Is a Mail Server

#zimbra #cve202566376 #exposuremanagement #zoomeye

Why "Zimbra Web Client" Appears Half a Million Times and Almost None of It Is a Mail Server

CISA advisory AA26-204A, released 23 July 2026, describes a Russian state-supported group tracked primarily as LAUNDRY BEAR compromising Zimbra Collaboration Suite deployments through CVE-2025-66376. The flaw allows a JavaScript payload embedded in an email body to run when the message is viewed, and the advisory states the actors collected the previous 90 days of mail, the Global Address List, two-factor authentication tokens and application passcodes.

Any scoping exercise that starts from that advisory runs into the same trap quickly, and it is a trap made of string matching.

One phrase, two completely different populations

A global ZoomEye query for http.body="Zimbra Web Client", captured on 25 September 2026, returns 537,391 assets. A query for the application fingerprint, app="Zimbra", returns 210,812.

The body query returns two and a half times as many assets as the fingerprint query. Some of that difference is real coverage, because fingerprints depend on what a scanner can identify from banners and headers. A large part of it is not. The string appears in product manuals, migration guides, forum threads, university help-desk pages, archived marketing sites and job postings. Each of those is a legitimate match for a body-text search and none of them is a mail server.

The narrow product title behaves in the opposite way. title="Zimbra Collaboration Suite" returns 3,661 assets, and title="Zimbra Collaboration Suite" && port="443" returns 265. Precision here comes at the cost of coverage: an operator who changed the login page title disappears from these results entirely.

Three kinds of evidence, ranked

It helps to sort the available fields by how easily they can be produced accidentally.

Body strings are the weakest. Anything that quotes the product name, including this article, becomes a candidate. http.body="Zimbra Collaboration Suite" returns 970,623 assets, which is a useful discovery pool and a poor population estimate.

Titles are stronger. A page title is usually set by whoever configured the application, and title="Zimbra" returns 260,797 assets. That number sits between the body result and the fingerprint result, which is roughly what the ranking predicts.

Fingerprints and certificates are the strongest. app="Zimbra" returns 210,812 assets, and ssl="Zimbra" && title="Zimbra" returns 63,239. A certificate naming the product is presented at the TLS layer by the operator, and the intersection of certificate and title evidence is difficult to produce by accident.

What a defender should do with this

Use the body query to find candidates, then raise the bar. A practical filter chain:

  1. app="Zimbra" for deployments the scanner recognizes as the product.
  2. app="Zimbra" && port="443", which returns 84,557, to keep the encrypted web interface that the advisory's exploit targets.
  3. ssl="Zimbra" && title="Zimbra" to isolate assets with two independent operator-published signals.

Each step removes assets. What remains is a list short enough to verify by host, which is the only place where patch level can be determined.

The measurement that matters is the gap

Absolute counts invite overconfidence. The more informative number is the gap between the loose and strict definitions of the same product. A body search that returns half a million assets while the fingerprint returns two hundred thousand is telling the defender something specific: their discovery queries are noisier than their inventory.

That gap is also the reason the advisory's reconnaissance section is credible. The actors used port scanning and commercial fingerprinting datasets rather than a single keyword search. Combining fields the way ZoomEye allows is what turns a large noisy number into a short list.

A note on scope. All counts were captured on 25 September 2026 with global ZoomEye queries and describe internet-visible assets. A body-text match is not evidence that a host runs the product, let alone that it is vulnerable.

References

Top comments (0)