Zimbra Update Patches Critical Vulnerabilities

Summary

Zimbra has released updates to address several critical vulnerabilities in its Collaboration Suite (ZCS). These include a command injection flaw in the SNMP monitoring component, multiple cross-site scripting (XSS) defects in the Classic Web Client, a mail forwarding restriction bypass, and issues related to access control, authorization, and server-side request forgery (SSRF). Users are urged to update to version 10.1.20.

Full text

Zimbra on Monday announced patches for several critical-severity vulnerabilities, including a command injection bug disclosed in late June. The critical command injection impacts the SNMP monitoring component of the collaboration suite if SNMP notifications are enabled and the integrated Swatchdog service is running. An unauthenticated attacker could send crafted payloads to execute arbitrary OS commands in the background and compromise the email server. Zimbra Collaboration Suite (ZCS) version 10.1.20 includes a permanent fix for the bug. The update also patches four cross-site scripting (XSS) defects in the Classic Web Client (Classic UI) that could lead to script execution under certain conditions. The flaws can be exploited via malicious attachment filenames, crafted fields, and crafted attachments. It also resolves CVE-2026-50055, a mail forwarding restriction bypass where authenticated attackers could exfiltrate emails even if mail forwarding restrictions are enabled.Advertisement. Scroll to continue reading. Additionally, it resolves an access control vulnerability in the EWS extension (CVE-2026-10631), an authorization issue in mailbox delegation (CVE-2026-50054), and a server-side request forgery (SSRF) bug in the Nextcloud integration. Zimbra has refrained from sharing further details on these security defects, but urges users to update to ZCS 10.1.20 as soon as possible. However, it makes no mention of any of these issues being exploited in the wild. The fresh security update arrived roughly two weeks after Zimbra patched a critical XSS security bug in the Classic Web Client that could lead to code execution when opening an email. Related: SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch Related: OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability Related: Chrome 150 Update Patches Severe Memory Safety Bugs Related: WP2Shell WordPress Vulnerabilities Exploited in the Wild Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Hugging Face Hacked in Autonomous AI AttackChrome 150 Update Patches Severe Memory Safety BugsBeacon Security Raises $13 Million for Security Data PlatformCyberattack Disrupts Operations of Japanese Frozen Food Giant NichireiRisk Ledger Raises $32 Million in Series B FundingFresh SharePoint Vulnerability Exploited Soon After DisclosureCoca-Cola Suspends US Fairlife Production Due to Ransomware AttackOak Emerges From Stealth Mode With $60 Million in Funding Latest News Clover Health Investments Discloses Data BreachExploitation of ServiceNow Vulnerability Seen Days After DisclosureNeo Emerges From Stealth With $100M to Control and Secure Enterprise AI SoftwareSonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before PatchOpenSSL Silently Fixes ‘HollowByte’ DoS VulnerabilityNew Index Tracks Material Breaches — And Refuses to Add Up the LossesErnst & Young Data Breach Affects Personal, Financial InformationWatch on Demand: Cloud & Data Security Summit Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Closing the Exploitation Gap July 22, 2026 Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveJazz has named Sean Robinson, Rickie Goyal, Danielle Guetta, Shani Nago, and Lior Magram as VPs and Michael Calev as COO.AJ Shipley has been appointed Chief Product Officer at CrowdStrike.Brinqa has named Ron Dovich as Chief AI and Automation Officer, David Allen as CTO, Steve Biagioni as CFO, and James Walta as VP of Product.More People On The MoveExpert Insights Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) How to Conduct a Successful Audit of AI-Driven Software Development As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production. (Matias Madou) Frontier AI: Six Questions Every Enterprise Should Ask Security Vendors From model selection and automation to validation and measurable results, the right questions can help enterprises separate genuine AI capabilities from marketing hype. (Joshua Goldfarb) The AI Token Costs That Can Break Cybersecurity As cybersecurity platforms embrace agentic AI, organizations must balance detection performance against the escalating costs of token consumption, deployment architecture, and AI credits. (Danelle Au) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-50055
• cve — CVE-2026-10631
• cve — CVE-2026-50054

Entities