CVE-2025-54391: Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 9.1 Critical.
Data as of 26 Oct 2026, 12:29 UTC
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 50% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 16 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
European organizations should take immediate steps to mitigate this vulnerability beyond waiting for an official patch. First, restrict access to the Zimbra SOAP API endpoints by implementing network-level controls such as IP whitelisting and segmentation to limit exposure to trusted internal networks only. Second, enforce strict monitoring and logging of 2FA configuration changes and authentication events to detect suspicious activities promptly. Third, consider temporarily disabling the EnableTwoFactorAuthRequest SOAP endpoint if feasible, or applying custom access controls or web application firewall (WAF) rules to block unauthorized requests targeting this endpoint. Fourth, enhance user credential security by enforcing strong password policies and considering additional layers of authentication such as hardware tokens or biometric factors where possible. Finally, maintain close communication with Zimbra vendors and subscribe to security advisories to apply patches immediately upon release. Conduct regular security awareness training to alert users about potential phishing attempts that could leverage compromised credentials.
Description
A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with valid user credentials to bypass Two-Factor Authentication (2FA) protection. The attacker can configure an additional 2FA method (either a third-party authenticator app or email-based 2FA) without presenting a valid authentication token or proving access to an already configured 2FA method. This bypasses 2FA and results in unauthorized access to accounts that are otherwise protected by 2FA.