Zimbra Collaboration vulnerabilities
9 published CVEs name Zimbra Collaboration among the affected products; CISA lists 2 of them as exploited in the wild.
- Published CVEs
- 9
- Last 12 months
- 8
- Critical
- 0
- Known exploited
- 2
Critical 0High 2Medium 3Low 4Not scored 0
CVEs per yearBy the year they were published
- 20251
- 20268
Known exploitedNewest addition to KEV first
- CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP…
Zimbra · Collaboration
ExploitedHigh8.9 - CVE-2025-66376
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an…
Zimbra · Collaboration
ExploitedHigh7.2
Newest CVEs
- CVE-2026-73576
In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The…
Zimbra · Collaboration
Medium6.3 - CVE-2026-73575
In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra…
Zimbra · Collaboration
Low3.1 - CVE-2026-73574
In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu…
Zimbra · Collaboration
Low3.1 - CVE-2026-73573
In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper…
Zimbra · Collaboration
Low3.1 - CVE-2026-73572
In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient…
Zimbra · Collaboration
Medium6.1 - CVE-2026-73571
An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending…
Zimbra · Collaboration
Low3.1 - CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP…
Zimbra · Collaboration
ExploitedHigh8.9 - CVE-2025-66376
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an…
Zimbra · Collaboration
ExploitedHigh7.2 - CVE-2025-62763
Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.
Zimbra · Collaboration
Medium5.0