What’s Vulnerable › Products
Zimbra Collaboration vulnerabilities
112 known vulnerabilities, 18 confirmed exploited in the wild (CISA KEV), 45 published in the last 12 months.
Check whether your Zimbra Collaboration version is affected
Exploited Zimbra Collaboration vulnerabilities
- CVE-2026-73570 — Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
- CVE-2025-48700 — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- CVE-2025-66376 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
- CVE-2020-7796 — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
- CVE-2025-68645 — Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
- CVE-2025-27915 — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- CVE-2019-9621 — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2023-34192 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- CVE-2024-45519 — Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
- CVE-2023-37580 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- CVE-2022-27926 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- CVE-2022-41352 — Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
- CVE-2022-37042 — Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
- CVE-2022-27925 — Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
- CVE-2022-27924 — Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability
- CVE-2018-6882 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- CVE-2022-24682 — Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
- CVE-2019-9670 — Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Latest Zimbra Collaboration vulnerabilities
- CVE-2026-93640 — Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration (CVSS 7.8)
- CVE-2026-115786 — Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion (CVSS 6.5)
- CVE-2026-115785 — Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address (CVSS 4.3)
- CVE-2026-50057 — Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions (CVSS 7.8)
- CVE-2026-50056 — Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection (CVSS 7.8)
- CVE-2026-93639 — Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation (CVSS 8.7)
- CVE-2026-93638 — Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter (CVSS 6.1)
- CVE-2026-93636 — Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name (CVSS 4.3)
- CVE-2026-93634 — Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records (CVSS 4.3)
- CVE-2026-93633 — Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters (CVSS 5.4)
- CVE-2026-93631 — Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking (CVSS 7.1)
- CVE-2026-93630 — Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization (CVSS 4.3)
- CVE-2026-93629 — Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity (CVSS 5.3)
- CVE-2026-93628 — Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response (CVSS 5.3)
- CVE-2026-93627 — Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer (CVSS 5.3)
- CVE-2026-50053 — Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters (CVSS 8.7)
- CVE-2026-10632 — Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter (CVSS 8.7)
- CVE-2026-93637 — Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting (CVSS 3.7)
- CVE-2026-93635 — Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution (CVSS 5.3)
- CVE-2026-50055 — Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion (CVSS 6.5)
- CVE-2026-50054 — Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right (CVSS 7.1)
- CVE-2026-10631 — Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier (CVSS 6.5)
- CVE-2026-73576 — (CVSS 6.5)
- CVE-2026-73575 — (CVSS 3.5)
- CVE-2026-73574 — (CVSS 6.5)