Zimbra

Products

Exploited and recent CVEs

• CVE-2026-73570 High 8.9 Exploited A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitiz 71.7%
• CVE-2025-66376 High 7.2 Exploited Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message. 20.2%
• CVE-2026-115786 Medium 6.5 Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion 0.4%
• CVE-2026-115785 Medium 4.3 Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address 0.7%
• CVE-2026-93640 High 7.8 Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration 0.1%
• CVE-2026-50057 High 7.8 Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions 0.3%
• CVE-2026-50056 High 7.8 Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection 0.3%
• CVE-2026-93639 High 8.7 Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation 0.4%
• CVE-2026-93638 Medium 6.1 Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter 0.3%
• CVE-2026-93636 Medium 4.3 Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name 0.3%
• CVE-2026-93634 Medium 4.3 Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records 0.3%
• CVE-2026-93633 Medium 5.4 Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters 0.2%
• CVE-2026-93631 High 7.1 Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking 0.2%
• CVE-2026-93630 Medium 4.3 Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization 0.3%
• CVE-2026-93629 Medium 5.3 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity 0.3%
• CVE-2026-93628 Medium 5.3 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response 0.3%
• CVE-2026-93627 Medium 5.3 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer 0.3%
• CVE-2026-50053 High 8.7 Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters 0.3%
• CVE-2026-10632 High 8.7 Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter 0.3%
• CVE-2026-93637 Low 3.7 Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting 0.3%
• CVE-2026-93635 Medium 5.3 Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution 0.2%
• CVE-2026-50055 Medium 6.5 Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion 0.4%
• CVE-2026-50054 High 7.1 Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right 0.2%
• CVE-2026-10631 Medium 6.5 Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier 0.3%
• CVE-2026-93647 Critical 9.3 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address 0.2%
• CVE-2026-93643 Critical 9.8 Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request 1.0%
• CVE-2026-93642 Critical 9.3 Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation 0.2%
• CVE-2026-93641 Critical 9.3 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation 0.3%
• CVE-2026-73576 Medium 6.3 In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure ra 0.3%
• CVE-2026-73575 Low 3.1 In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient val 0.2%