Loading story…
Zimbra released Zimbra Collaboration Suite 10.1.20 to patch multiple critical and high-severity vulnerabilities affecting its email and collaboration platform, including versions of the Classic Web Client prior to 10.1.20. The most serious issue is a critical unauthenticated command injection flaw in the SNMP monitoring component that could allow arbitrary operating system command execution when SNMP notifications are enabled and the integrated Swatchdog service is running. Zimbra and the Canadian Centre for Cyber Security urged administrators and users to review the advisory and apply the update promptly.
The release also fixes four cross-site scripting vulnerabilities in the Classic Web Client, a mail forwarding restriction bypass tracked as CVE-2026-50055, an access control flaw in the EWS extension tracked as CVE-2026-10631, an authorization issue in mailbox delegation tracked as CVE-2026-50054, and a server-side request forgery bug in the Nextcloud integration. Zimbra said customers should update as soon as possible and did not report evidence that the vulnerabilities had been exploited in the wild.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Following the advisory, the Canadian Centre for Cyber Security encouraged users and administrators to review Zimbra's notice and apply the necessary updates. The guidance referenced the patch release update to Zimbra 10.1.20.
On 2026-07-20, Zimbra published security advisory AV26-721 and released Zimbra Collaboration Suite 10.1.20 to address multiple vulnerabilities. The update includes fixes for critical and high-severity issues affecting the Classic Web Client and other components.
On 2026-06-26, Zimbra had previously disclosed the critical SNMP command injection vulnerability later fixed in ZCS 10.1.20. At that time, administrators only had a temporary mitigation until the permanent patch became available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesecurityonline.info
Open sourcesecurityweek.com
Open sourcecyberveille.ch
Open sourcemalware.news
Open sourceblog.zimbra.com
Open sourcewiki.zimbra.com
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zimbra released **version 10.1.16** with a strong recommendation that administrators upgrade immediately, citing high-severity issues and deployment risk. The update addresses multiple injection-class vulnerabilities affecting the collaboration suite, including **cross-site scripting (XSS)** in *Webmail* and *Briefcase* that could enable session hijacking and data theft via malicious script injection in a user’s browser. The release also patches an **XML External Entity (XXE)** flaw in the **EWS SOAP endpoint**, which could potentially be abused for local file disclosure, denial-of-service conditions, or **SSRF** depending on environment and parser behavior, and fixes an **authenticated LDAP injection** issue where insufficient sanitization could allow a logged-in user to manipulate LDAP queries to access or influence directory data. In addition to these targeted fixes, Zimbra reports broader hardening such as **stronger CSRF protections** through improved token validation, alongside other security-related stability adjustments.
Jun 29, 2026
Zimbra has urged customers to upgrade to **Zimbra Collaboration 10.1.19** to remediate a critical stored cross-site scripting flaw in the **Classic Web Client**. The vulnerability, which does not yet have a CVE identifier, can be triggered through a specially crafted email and may execute malicious code when a user opens the message in the Classic UI. Successful exploitation could expose **session data, account settings, and mailbox contents**, creating a direct path to account compromise and data theft. The issue was reported by **Google Threat Analysis Group**, and Zimbra said it has **no evidence of active exploitation** so far. The warning has drawn added attention because Zimbra products have been repeatedly targeted in recent years by Russian state-linked groups including **Winter Vivern**, **APT29**, and **APT28**, while other Zimbra flaws have also appeared in **CISA KEV** and been used in campaigns against government, military, and Ukrainian entities.
Jul 13, 2026
More than 10,000 internet-exposed **Zimbra Collaboration Suite** servers remain vulnerable to `CVE-2025-48700`, an actively exploited cross-site scripting flaw that affects ZCS versions `8.8.15`, `9.0`, `10.0`, and `10.1`. The bug lets unauthenticated attackers execute arbitrary JavaScript in a victim’s session and steal sensitive data when a user opens a malicious email in the **Zimbra Classic UI**. Synacor released patches in June 2025, but Shadowserver still reported roughly **10,500** exposed unpatched systems, with the largest concentrations in Asia and Europe. **CISA** has added `CVE-2025-48700` to its **Known Exploited Vulnerabilities** catalog and ordered Federal Civilian Executive Branch agencies to secure affected servers within days because the flaw is being abused in the wild. The warning follows a broader pattern of Zimbra vulnerabilities being used in espionage-focused campaigns, with reporting linking earlier exploitation of similar flaws to Russian-aligned groups including **APT28**, **APT29**, and **Winter Vivern** against Ukrainian entities, NATO-aligned organizations, and other targets.
Jun 29, 2026