CVE-2016-10034: The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2....

Security readout for executives and security teams

This flaw affects Zend Mail’s Sendmail adapter and older Zend Framework versions. A crafted sender email address may let a remote attacker pass extra parameters to the mail command, leading to arbitrary code execution. Public exploit references exist, but the bundle does not show CISA KEV listing or confirmed active exploitation. Exposure is likely in PHP applications using Zend Framework or zend-mail with the Sendmail adapter, especially where user-controlled email addresses are accepted for sender fields. Systems using different mail transports may not be affected, but source evidence is limited to the named component and versions. Treat as high priority for legacy Zend-based web applications because it can become remote code execution and has public exploit references. Prioritize externally reachable forms or workflows that send mail from user-provided addresses. Mitigation focus: Upgrade zend-mail to 2.4.11 or 2.7.2 or later as applicable.; Update Zend Framework to a fixed vendor-supported release.; Identify applications using Zend Mail Sendmail transport with user-supplied sender addresses..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.