Zimbra 10.1.20 Fixes Critical Command Injection and Multiple Web Client Flaws

Zimbra released Zimbra Collaboration Suite 10.1.20 to patch multiple critical and high-severity vulnerabilities affecting its email and collaboration platform, including versions of the Classic Web Client prior to 10.1.20. The most serious issue is a critical unauthenticated command injection flaw in the SNMP monitoring component that could allow arbitrary operating system command execution when SNMP notifications are enabled and the integrated Swatchdog service is running. Zimbra and the Canadian Centre for Cyber Security urged administrators and users to review the advisory and apply the update promptly.

The release also fixes four cross-site scripting vulnerabilities in the Classic Web Client, a mail forwarding restriction bypass tracked as CVE-2026-50055, an access control flaw in the EWS extension tracked as CVE-2026-10631, an authorization issue in mailbox delegation tracked as CVE-2026-50054, and a server-side request forgery bug in the Nextcloud integration. Zimbra said customers should update as soon as possible and did not report evidence that the vulnerabilities had been exploited in the wild.