en
Zimbra is an open-source-based provider of enterprise email and collaboration software. Its core offering combines messaging, calendaring, contacts, tasks, file sharing, chat, and document collaboration. Organizations can deploy it on premises, in private or public cloud environments, or in hybrid arrangements, with support delivered through Zimbra and its partner ecosystem.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/22/2026, Zimbra recorded 16 security vulnerabilities in the last 90 days across 3 products, including 6 rated High or above and 1 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Collaboration had the most security vulnerabilities in the Zimbra ecosystem, with 7 vulnerabilities—approximately 43.75% of the provider's total vulnerabilities during this period.
CVE-2026-93637Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate LimitingCVE-2026-93635Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template SubstitutionCVE-2026-50055Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable ExpansionCVE-2026-50054Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation RightCVE-2026-10631Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier80 Results | Page 1 of 8
| SeverityMedium |
| SeverityMedium |
| SeverityHigh |
| SeverityMedium |
| SeverityCritical |
| SeverityCritical |
| SeverityCritical |
| SeverityCritical |