Zimbra Zimbra Collaboration Suite
22 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-115786 | ≤ 10.1.20 | Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-115785 | ≤ 10.1.20 | Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address | MEDIUM 4.3 | 0.7 % | ||
| CVE-2026-93640 | ≤ 10.1.21 | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration | HIGH 7.8 | 0.1 % | ||
| CVE-2026-50057 | ≤ 10.1.21 | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions | HIGH 7.8 | 0.3 % | ||
| CVE-2026-50056 | ≤ 10.1.21 | Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection | HIGH 7.8 | 0.3 % | ||
| CVE-2026-93639 | ≤ 10.1.20 | Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation | HIGH 8.7 | 0.4 % | ||
| CVE-2026-93638 | ≤ 10.1.17 | Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-93636 | ≤ 10.1.21 | Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-93634 | ≤ 10.1.20 | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-93633 | ≤ 10.1.20 | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-93631 | ≤ 10.1.20 | Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking | HIGH 7.1 | 0.2 % | ||
| CVE-2026-93630 | < 10.1.21 | Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-93629 | ≤ 10.1.21 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-93628 | ≤ 10.1.21 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-93627 | ≤ 10.1.21 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-50053 | ≤ 10.1.17 | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters | HIGH 8.7 | 0.3 % | ||
| CVE-2026-10632 | < 10.1.17 | Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter | HIGH 8.7 | 0.3 % | ||
| CVE-2026-93637 | ≤ 10.1.21 | Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting | LOW 3.7 | 0.3 % | ||
| CVE-2026-93635 | ≤ 10.1.21 | Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-50055 | < 10.1.20 | Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-50054 | < 10.1.20 | Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right | HIGH 7.1 | 0.2 % | ||
| CVE-2026-10631 | < 10.1.20 | Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier | MEDIUM 6.5 | 0.3 % |