When Business Email Compromise Starts Rewriting Reality

What it is

This Rapid7/Zimbra research post describes a class of write-access bugs in Zimbra Collaboration Suite that let an attacker actively fabricate content a victim trusts — not just read mailboxes — by sending as another user, hiding or altering what appears in a mailbox, and modifying shared calendar/document data. It's framed as the first in a series; the technical CVE details for these specific new bugs are promised in later installments, not given here.

How it works

Three mechanisms are described concretely:

• Mailbox rewriting: an attacker can send mail impersonating a target (e.g., a CFO) without their credentials, then choose to either delete the sent item (erasing the trail) or leave it in Sent Items — creating a "gaslighting" scenario where the purported sender sees no record while the recipient sees a sent message, producing conflicting evidence during incident response.
• Document planting: fake files (e.g., an HR restructuring memo) can be placed in a user's enterprise drive to look like it came from a trusted peer, then corroborated by a follow-up email referencing it.
• Calendar warfare: meetings can be created, modified, or deleted without generating the notification trail users expect; RSVP status can be silently flipped (e.g., Accepted → Declined), influencing real decisions (rescheduling, proceeding without an exec). A believable "Emergency Board Meeting" invite with a malicious Zoom link can sit on a calendar for days before a popup reminder fires, removing the "just arrived" suspicion cue normal phishing relies on.

Preconditions / Affected

Zimbra Collaboration Suite generally; the post states Rapid7 and Zimbra jointly found 50+ vulnerabilities, with "several" enabling these write/impersonation behaviors. No specific CVE IDs, version numbers, or patch status are given for these particular bugs — that detail is deferred to future posts in the series.

What to do

The post gives no patches, commands, or detections for the newly disclosed bugs — it's explicitly a preview piece. The one concrete pattern worth watching for operationally: discrepancies between what a sender recalls sending and what appears in Sent Items, and calendar events/RSVPs that changed without a corresponding notification, since the post calls out notification-trail suppression as the specific gap attackers exploit.

Caveats

This is the first of a planned series — technical details, affected versions, and remediation for the 50+ vulnerabilities are not in this post and are explicitly deferred to upcoming installments.