Is CVE-2024-54663 actively exploited?

No active exploitation of CVE-2024-54663 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-54663 be exploited remotely?

Yes. CVE-2024-54663 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-54663?

CVE-2024-54663 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2024-54663

HIGH

CVE-2024-54663

CWE-829Published: December 19, 2024· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.

NVD Source

Technical Analysis

CVE-2024-54663 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.