Zimbra 10.1.16 Security Update Patches XSS, XXE, and Authenticated LDAP Injection
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Feb 13, 2026
Zimbra released version 10.1.16 with a strong recommendation that administrators upgrade immediately, citing high-severity issues and deployment risk. The update addresses multiple injection-class vulnerabilities affecting the collaboration suite, including cross-site scripting (XSS) in Webmail and Briefcase that could enable session hijacking and data theft via malicious script injection in a user’s browser.
The release also patches an XML External Entity (XXE) flaw in the EWS SOAP endpoint, which could potentially be abused for local file disclosure, denial-of-service conditions, or SSRF depending on environment and parser behavior, and fixes an authenticated LDAP injection issue where insufficient sanitization could allow a logged-in user to manipulate LDAP queries to access or influence directory data. In addition to these targeted fixes, Zimbra reports broader hardening such as stronger CSRF protections through improved token validation, alongside other security-related stability adjustments.
