Zimbra vulnerabilities and fixes

CVEs that mention Zimbra, ranked by priority. 17 tracked.

Zimbra has 17 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-10-23. Highest priority: CVE-2026-10632 (score 39/100).

• CVE-2026-10632 HIGH 8.7 A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) a
• CVE-2026-50053 HIGH 8.7 A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests
• CVE-2026-93639 HIGH 8.7 A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator wit
• CVE-2026-115786 MEDIUM 6.5 A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to c
• CVE-2026-115785 MEDIUM 4.3 An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite
• CVE-2026-93627 MEDIUM 5.3 An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS)
• CVE-2026-93628 MEDIUM 5.3 An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS)
• CVE-2026-93629 MEDIUM 5.3 An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email
• CVE-2026-50056 HIGH 7.8 A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) a
• CVE-2026-50057 HIGH 7.8 A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix
• CVE-2026-93640 HIGH 7.8 A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS
• CVE-2026-93631 HIGH 7.1 A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network
• CVE-2026-93638 MEDIUM 6.1 A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an
• CVE-2026-93630 MEDIUM 4.3 A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) all
• CVE-2026-93633 MEDIUM 5.4 A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefca
• CVE-2026-93636 MEDIUM 4.3 An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to que
• CVE-2026-93634 MEDIUM 4.3 A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user t

FAQ

How do I fix Zimbra vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Zimbra being exploited right now?

None of the tracked Zimbra CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Zimbra CVE should I patch first?

CVE-2026-10632 currently ranks highest (39/100): A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) a.

← Back to latest CVEs