Remote access to the Zimbra webmail of a university hospital does not simply involve entering a URL in a browser. Given network constraints, recent security alerts, and the gradual implementation of multi-factor authentication in healthcare facilities, connecting from outside the CHU de Reims requires some technical precautions that we detail here.
CVE-2026-73570: direct impact on Zimbra access exposed on the Internet
The CERT Santé issued a specific alert regarding Zimbra in August 2026. The vulnerability referenced as CVE-2026-73570 allows for a remotely exploitable command injection without prior authentication, provided that the optional zimbra-snmp package is installed and SNMP notifications are enabled on the server.
The recommendation from CERT Santé is clear: apply the available Zimbra patch and, in the meantime, uninstall or disable the SNMP component when it is not needed. For an institution like the CHU de Reims, this vulnerability directly influences the policy on exposing email on the Internet.
If the infrastructure team at the CHU applies a patch or temporarily restricts external access, you may encounter a timeout or a certificate error without apparent explanation. Before making multiple connection attempts, check with the IT department if a security maintenance is underway.
The login page mail.chu-reims.fr sometimes displays a message “Authentication Required,” which does not necessarily indicate a password problem. This message may reflect a temporary network restriction related to this type of patch.
To delve deeper into the connection procedure and the parameters to be filled in, a detailed guide on the Zimbra email of the CHU de Reims covers the steps in detail.
Multi-factor authentication and VPN access: what changes for Zimbra at CHU de Reims
For several years, ANSSI and specialized actors in hospital cybersecurity have pushed for mandatory multi-factor authentication (MFA) for any remote access to health information systems. Feedback from the field is unequivocal: too many VPN accounts lack strong authentication mechanisms, which exposes the entire information system.
For an agent of the CHU de Reims connecting from home or while traveling, this translates into an additional layer during authentication. The usual scheme (username + password on the webmail) tends to be supplemented by a second factor, often a temporary code sent via SMS or generated by a dedicated application.
We recommend checking several points before any attempt to connect externally:
- Is the institutional VPN required to access mail.chu-reims.fr from outside, or is the webmail directly exposed on the Internet? The answer varies depending on periods and decisions from the IT department.
- Is MFA enabled on your account? If so, ensure you have configured the application or associated phone number before leaving the internal network.
- Is your password up to date? The CHU provides a reset procedure, but this operation may require internal access or a visit to the IT department.
The most common error we observe: an agent configures MFA on their hospital workstation, then changes their personal phone, and finds themselves locked out due to not updating the second factor. Anticipate updating MFA before any device change.
Choice of Zimbra client: Modern, Classic, or mobile from outside
The Zimbra login page of the CHU offers three access modes: Modern, Classic, and Default. This technical choice has a direct impact on the remote connection experience, especially on home or mobile networks with variable bandwidth.
The Modern client consumes more bandwidth than the Classic client. On an unstable 4G connection or a shared Wi-Fi network, the initial loading may fail or take an unusually long time. In this case, switching to the Classic client (available via the login page menu) significantly reduces network load.
For access from a smartphone, the Mobile mode remains the best option. It is a streamlined interface designed for touch screens and low-bandwidth connections. The URL remains the same (mail.chu-reims.fr), but the client=mobile parameter is automatically added if you choose this option on the login screen.
A often overlooked point: the client preference is stored on the server side. If you have selected “Default” and your stored preference is Modern, each external connection will attempt to load the full interface. To change this setting, you need to access the settings from the internal network (Settings > General > Zimbra Version in Modern mode, or Preferences > General in Classic mode).
IMAP synchronization and third-party clients: technical settings for external connection
Some agents prefer to use Thunderbird, Outlook, or their system’s native Mail application rather than the webmail. IMAP synchronization from outside depends on the opening of ports by the CHU’s IT department.
The parameters to be filled in follow the standard Zimbra scheme:
- Incoming IMAP server: generally mail.chu-reims.fr, port 993, SSL/TLS encryption
- Outgoing SMTP server: same host, port 465 or 587 depending on the configuration, SSL/TLS or STARTTLS encryption
- Username: your full address ([email protected]) or your network username according to the CHU’s Active Directory configuration
If the IMAP connection fails from outside while it works on the internal network, port 993 is likely filtered on the institutional firewall. In this case, only the webmail remains accessible, and using the VPN may unlock IMAP access.
One last technical point: the SSL certificates used by the CHU’s Zimbra server must be recognized by your mail client. If you receive a certificate alert, do not ignore it. Check that the certificate is indeed issued for the domain chu-reims.fr and that it has not expired. A persistent alert may signal a man-in-the-middle attack, particularly concerning in a health data context.
External connection to Zimbra at the CHU de Reims remains technically accessible, but security layers are strengthened with each update cycle. Keeping your VPN configured, your MFA operational, and your client settings up to date avoids most of the blocks we observe in support.