Zimbra vulnerabilities
We track 24 vulnerabilities in Zimbra products across 3 products. 22 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on October 23, 2026.
Latest Zimbra vulnerabilities
- 7.8 High severity
Zimbra Collaboration Suite: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wr
- 8.7 High severity
Zimbra Collaboration Suite: Missing Authorization
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add a
- 7.1 High severity
Zimbra Collaboration Suite: Cross-Site Request Forgery
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or
- 7.8 High severity
Zimbra Collaboration Suite: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration command
- 7.8 High severity
Zimbra Collaboration Suite: Improper Neutralization of Argument Delimiters in a Command
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately res
- 8.7 High severity
Zimbra Collaboration Suite: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script att
- 7.1 High severity
Zimbra Collaboration Suite: Improper Privilege Management
An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives pa
- 9.3 Critical severity
Zimbra Collaboration Suite (ZCS): Improper Neutralization of Input During Web Page Generation
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
- 9.8 Critical severity
Zimbra Collaboration Suite (ZCS): Improper Limitation of a Pathname to a Restricted Directory
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.
- 9.3 Critical severity
Zimbra Collaboration Suite (ZCS): Improper Neutralization of Input During Web Page Generation
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
- 9.3 Critical severity
Zimbra Collaboration Suite (ZCS): Improper Neutralization of Input During Web Page Generation
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
- 8.9 High severity
Zimbra Collaboration Suite (ZCS) OS Command Injection Exploited
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing
- 6.1 Medium severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Exploited
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
- 8.8 High severity
collaboration: Server-Side Request Forgery
An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization
- 7.5 High severity
Collaboration: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to in
- 6.1 Medium severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Exploited
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calend
- 7.8 High severity
collaboration: Improper Handling of Exceptional Conditions
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges f
- 8.8 High severity
Collaboration: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function.
- 9.8 Critical severity
Collaboration: Incorrect Authorization
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters.
- 7.8 High severity
Collaboration: Improper Neutralization of Special Elements used in a Command
In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to local privilege escalation (LPE).
- 7.2 High severity
Collaboration: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload files through the ClientUploader utility, and traverse to any ot
- 7.8 High severity
Zimbra Server: Improper Access Control
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, whi
- 7.5 High severity
Collaboration: Server-Side Request Forgery
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is
- 9.8 Critical severity
Collaboration: Incorrect Authorization
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced.