Zimbra vulnerabilities
39 CVEs and advisories name Zimbra as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-115786Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion
- CVE-2026-115785Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address
- CVE-2026-93640Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration
- CVE-2026-50057Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions
- CVE-2026-50056Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection
- CVE-2026-93639Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation
- CVE-2026-93638Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter
- CVE-2026-93636Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name
- CVE-2026-93634Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records
- CVE-2026-93633Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
- CVE-2026-93631Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking
- CVE-2026-93630Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
- CVE-2026-93629Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity
- CVE-2026-93628Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response
- CVE-2026-93627Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer
- CVE-2026-50053Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters
- CVE-2026-10632Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter
- CVE-2026-93637Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
- CVE-2026-93635Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
- CVE-2026-50055Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion
- CVE-2026-50054Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right
- CVE-2026-10631Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier
- CVE-2026-93647Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address
- CVE-2026-93643Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request
- CVE-2026-93642Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation
- CVE-2026-93641Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
- CVE-2026-73576In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration.
- CVE-2026-73575In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) en
- CVE-2026-73574In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper v
- CVE-2026-73573In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality d