Zimbra vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20241
3. 20242
4. 202633
5. 20262

Known exploitedNewest addition to KEV first

• CVE-2026-73570

  A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP…

  Zimbra · Collaboration

  ExploitedHigh8.9
• CVE-2025-66376

  Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an…

  Zimbra · Collaboration

  ExploitedHigh7.2

Newest CVEs

• CVE-2026-115786

  Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion

  Zimbra · Zimbra Collaboration Suite

  Medium6.5
• CVE-2026-115785

  Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address

  Zimbra · Zimbra Collaboration Suite

  Medium4.3
• CVE-2026-93640

  Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration

  Zimbra · Zimbra Collaboration Suite

  High7.8
• CVE-2026-50057

  Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions

  Zimbra · Zimbra Collaboration Suite

  High7.8
• CVE-2026-50056

  Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection

  Zimbra · Zimbra Collaboration Suite

  High7.8
• CVE-2026-93639

  Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation

  Zimbra · Zimbra Collaboration Suite

  High8.7
• CVE-2026-93638

  Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter

  Zimbra · Zimbra Collaboration Suite

  Medium6.1
• CVE-2026-93636

  Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name

  Zimbra · Zimbra Collaboration Suite

  Medium4.3
• CVE-2026-93634

  Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records

  Zimbra · Zimbra Collaboration Suite

  Medium4.3
• CVE-2026-93633

  Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters

  Zimbra · Zimbra Collaboration Suite

  Medium5.4