Zimbra vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-93640 A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files wHigh 7.8 · Oct 23, 2026
• CVE-2026-93639 A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite gHigh 8.7 · Oct 23, 2026
• CVE-2026-93631 A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-conHigh 7.1 · Oct 23, 2026
• CVE-2026-50057 A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as rHigh 7.8 · Oct 23, 2026
• CVE-2026-50056 A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitraryHigh 7.8 · Oct 23, 2026
• CVE-2026-50053 A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended fHigh 8.7 · Oct 23, 2026
• CVE-2026-10632 A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through theHigh 8.7 · Oct 23, 2026
• CVE-2026-50054 An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local accouHigh 7.1 · Oct 8, 2026
• CVE-2026-93647 An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address.Critical 9.3 · Sep 25, 2026
• CVE-2026-93643 When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigCritical 9.8 · Sep 25, 2026
• CVE-2026-93642 An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attCritical 9.3 · Sep 25, 2026
• CVE-2026-93641 An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the atCritical 9.3 · Sep 25, 2026
• CVE-2024-45518 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46.High 8.8 · Oct 22, 2024
• CVE-2024-33535 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.High 7.5 · Aug 12, 2024
• CVE-2024-27442 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.High 7.8 · Aug 12, 2024
• CVE-2023-41106 An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3.High 7.5 · Dec 7, 2023
• CVE-2023-38750 In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed.High 7.5 · Jul 31, 2023
• CVE-2023-34193 File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientHigh 8.8 · Jul 6, 2023
• CVE-2023-29382 An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.Critical 9.8 · Jul 6, 2023
• CVE-2023-29381 An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and Critical 9.8 · Jul 6, 2023
• CVE-2023-24032 In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passHigh 7.8 · Jun 15, 2023
• CVE-2022-45912 An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0.High 7.2 · Dec 5, 2022
• CVE-2022-41347 An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15).High 7.8 · Sep 25, 2022
• CVE-2022-37041 An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0.High 7.5 · Aug 12, 2022
• CVE-2022-32294 Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command).Critical 9.8 · Jul 10, 2022