# cve.now: Zimbra

The newest entries naming Zimbra as an affected vendor (up to 200), of 39 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115786](https://cve.now/CVE-2026-115786.md): Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion (CVSS 6.5)
- [CVE-2026-115785](https://cve.now/CVE-2026-115785.md): Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address (CVSS 4.3)
- [CVE-2026-93640](https://cve.now/CVE-2026-93640.md): Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration (CVSS 7.8)
- [CVE-2026-50057](https://cve.now/CVE-2026-50057.md): Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions (CVSS 7.8)
- [CVE-2026-50056](https://cve.now/CVE-2026-50056.md): Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection (CVSS 7.8)
- [CVE-2026-93639](https://cve.now/CVE-2026-93639.md): Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation (CVSS 8.7)
- [CVE-2026-93638](https://cve.now/CVE-2026-93638.md): Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter (CVSS 6.1)
- [CVE-2026-93636](https://cve.now/CVE-2026-93636.md): Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name (CVSS 4.3)
- [CVE-2026-93634](https://cve.now/CVE-2026-93634.md): Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records (CVSS 4.3)
- [CVE-2026-93633](https://cve.now/CVE-2026-93633.md): Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters (CVSS 5.4)
- [CVE-2026-93631](https://cve.now/CVE-2026-93631.md): Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking (CVSS 7.1)
- [CVE-2026-93630](https://cve.now/CVE-2026-93630.md): Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization (CVSS 4.3)
- [CVE-2026-93629](https://cve.now/CVE-2026-93629.md): Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity (CVSS 5.3)
- [CVE-2026-93628](https://cve.now/CVE-2026-93628.md): Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response (CVSS 5.3)
- [CVE-2026-93627](https://cve.now/CVE-2026-93627.md): Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer (CVSS 5.3)
- [CVE-2026-50053](https://cve.now/CVE-2026-50053.md): Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters (CVSS 8.7)
- [CVE-2026-10632](https://cve.now/CVE-2026-10632.md): Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter (CVSS 8.7)
- [CVE-2026-93637](https://cve.now/CVE-2026-93637.md): Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting (CVSS 3.7)
- [CVE-2026-93635](https://cve.now/CVE-2026-93635.md): Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution (CVSS 5.3)
- [CVE-2026-50055](https://cve.now/CVE-2026-50055.md): Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion (CVSS 6.5)
- [CVE-2026-50054](https://cve.now/CVE-2026-50054.md): Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right (CVSS 7.1)
- [CVE-2026-10631](https://cve.now/CVE-2026-10631.md): Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier (CVSS 6.5)
- [CVE-2026-93647](https://cve.now/CVE-2026-93647.md): Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address (CVSS 9.3)
- [CVE-2026-93643](https://cve.now/CVE-2026-93643.md): Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request (CVSS 9.8)
- [CVE-2026-93642](https://cve.now/CVE-2026-93642.md): Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation (CVSS 9.3)
- [CVE-2026-93641](https://cve.now/CVE-2026-93641.md): Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation (CVSS 9.3)
- [CVE-2026-73576](https://cve.now/CVE-2026-73576.md): In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. (CVSS 6.3)
- [CVE-2026-73575](https://cve.now/CVE-2026-73575.md): In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) en (CVSS 3.1)
- [CVE-2026-73574](https://cve.now/CVE-2026-73574.md): In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper v (CVSS 3.1)
- [CVE-2026-73573](https://cve.now/CVE-2026-73573.md): In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality d (CVSS 3.1)
- [CVE-2026-73572](https://cve.now/CVE-2026-73572.md): In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due (CVSS 6.1)
- [CVE-2026-73571](https://cve.now/CVE-2026-73571.md): An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delega (CVSS 3.1)
- [CVE-2026-73570](https://cve.now/CVE-2026-73570.md): A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed (CVSS 8.9, KEV)
- [CVE-2025-66376](https://cve.now/CVE-2025-66376.md): Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import d (CVSS 7.2, KEV)
- [CVE-2025-62763](https://cve.now/CVE-2025-62763.md): Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy. (CVSS 5.0)
- [CVE-2024-9665](https://cve.now/CVE-2024-9665.md): Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability (CVSS 6.5)
- [CVE-2017-20191](https://cve.now/CVE-2017-20191.md): Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scripting (CVSS 3.5)
- [CVE-2017-20188](https://cve.now/CVE-2017-20188.md): Zimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scripting (CVSS 2.6)
- [CVE-2013-1938](https://cve.now/CVE-2013-1938.md): Zimbra 2013 has XSS in aspell.php (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zimbra
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.