Zimbra on Monday announced patches for several critical-severity vulnerabilities, including a command injection bug disclosed in late June.
The critical command injection impacts the SNMP monitoring component of the collaboration suite if SNMP notifications are enabled and the integrated Swatchdog service is running.
An unauthenticated attacker could send crafted payloads to execute arbitrary OS commands in the background and compromise the email server.
Zimbra Collaboration Suite (ZCS) version 10.1.20 includes a permanent fix for the bug.
The update also patches four cross-site scripting (XSS) defects in the Classic Web Client (Classic UI) that could lead to script execution under certain conditions. The flaws can be exploited via malicious attachment filenames, crafted fields, and crafted attachments.
It also resolves CVE-2026-50055, a mail forwarding restriction bypass where authenticated attackers could exfiltrate emails even if mail forwarding restrictions are enabled.
Additionally, it resolves an access control vulnerability in the EWS extension (CVE-2026-10631), an authorization issue in mailbox delegation (CVE-2026-50054), and a server-side request forgery (SSRF) bug in the Nextcloud integration.
Zimbra has refrained from sharing further details on these security defects, but urges users to update to ZCS 10.1.20 as soon as possible. However, it makes no mention of any of these issues being exploited in the wild.
The fresh security update arrived roughly two weeks after Zimbra patched a critical XSS security bug in the Classic Web Client that could lead to code execution when opening an email.
Related: SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch
Related: OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability
Related: Chrome 150 Update Patches Severe Memory Safety Bugs
Related: WP2Shell WordPress Vulnerabilities Exploited in the Wild
