- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/01/2026, Zimbra recorded 11 security vulnerabilities in the last 90 days across 2 products, including 5 rated High or above and 1 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Collaboration had the most security vulnerabilities in the Zimbra ecosystem, with 7 vulnerabilities—approximately 63.64% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-93647Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address | Exploitation statusNot known exploited | FixYes | Affected productZimbra Collaboration Suite (ZCS) | Published09/25/2026 | SeverityCritical |
CVE-2026-93643Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request | Exploitation statusNot known exploited | FixYes | Affected productZimbra Collaboration Suite (ZCS) | Published09/25/2026 | SeverityCritical |
CVE-2026-93642Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation | Exploitation statusNot known exploited | FixYes | Affected productZimbra Collaboration Suite (ZCS) | Published09/25/2026 | SeverityCritical |
CVE-2026-93641Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation | Exploitation statusNot known exploited | FixYes | Affected productZimbra Collaboration Suite (ZCS) | Published09/25/2026 | SeverityCritical |
CVE-2026-73576 | Exploitation statusNot known exploited | FixYes | Affected productCollaboration | Published08/13/2026 | SeverityMedium |
CVE-2026-73575 | Exploitation statusNot known exploited | FixYes | Affected productCollaboration | Published08/13/2026 | SeverityLow |
CVE-2026-73574 | Exploitation statusNot known exploited | FixYes | Affected productCollaboration | Published08/13/2026 | SeverityLow |
CVE-2026-73573 | Exploitation statusNot known exploited | FixYes | Affected productCollaboration | Published08/13/2026 | SeverityLow |
CVE-2026-73572 | Exploitation statusNot known exploited | FixYes | Affected productCollaboration | Published08/13/2026 | SeverityMedium |
CVE-2026-73571 | Exploitation statusNot known exploited | FixYes | Affected productCollaboration | Published08/13/2026 | SeverityLow |
CVE-2026-73570 | Exploitation statusKEV | FixYes | Affected productCollaboration | Published08/13/2026 | SeverityHigh |
CVE-2025-71275 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/24/2026 | SeverityUnknown |
CVE-2025-66376 | Exploitation statusKEV | FixYes | Affected productCollaboration | Published01/05/2026 | SeverityHigh |
CVE-2025-68645 | Exploitation statusKEV | FixNot confirmed | Affected productNot confirmed | Published12/22/2025 | SeverityHigh |
CVE-2025-67809 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/15/2025 | SeverityMedium |
CVE-2025-62763 | Exploitation statusNot known exploited | FixYes | Affected productCollaboration | Published10/21/2025 | SeverityMedium |
CVE-2024-45515 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/30/2025 | SeverityMedium |
CVE-2025-27914 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/12/2025 | SeverityMedium |
CVE-2024-9665Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productZimbra | Published11/22/2024 | SeverityMedium |
CVE-2024-45518 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/22/2024 | SeverityHigh |
CVE-2024-33535 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published08/12/2024 | SeverityHigh |
CVE-2024-27443 | Exploitation statusKEV | FixNot confirmed | Affected productNot confirmed | Published08/12/2024 | SeverityMedium |
CVE-2024-33536 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published08/12/2024 | SeverityMedium |
CVE-2024-27442 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published08/12/2024 | SeverityHigh |
CVE-2024-33533 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published08/12/2024 | SeverityMedium |
CVE-2017-20191Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scripting | Exploitation statusNot known exploited | FixYes | Affected productzm-admin-ajax | Published03/31/2024 | SeverityLow |
CVE-2023-26562 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/13/2024 | SeverityMedium |
CVE-2023-45206 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/13/2024 | SeverityMedium |
CVE-2023-50808 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/13/2024 | SeverityCritical |
CVE-2023-48432 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/13/2024 | SeverityMedium |
CVE-2023-45207 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/13/2024 | SeverityMedium |
CVE-2017-20188Zimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scripting | Exploitation statusNot known exploited | FixYes | Affected productzm-ajax | Published01/02/2024 | SeverityLow |
CVE-2023-43102 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published12/07/2023 | SeverityUnknown |
CVE-2023-43103 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published12/07/2023 | SeverityUnknown |
CVE-2023-41106 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published12/07/2023 | SeverityUnknown |
CVE-2023-38750 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/31/2023 | SeverityUnknown |
CVE-2023-34193 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/06/2023 | SeverityUnknown |
CVE-2023-29381 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/06/2023 | SeverityUnknown |
CVE-2023-29382 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/06/2023 | SeverityUnknown |
CVE-2023-24031 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/15/2023 | SeverityUnknown |
CVE-2023-24032 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/15/2023 | SeverityUnknown |
CVE-2023-24030 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/15/2023 | SeverityUnknown |
CVE-2022-45911 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/06/2023 | SeverityMedium |
CVE-2022-45913 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/06/2023 | SeverityMedium |
CVE-2022-45912 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/05/2022 | SeverityHigh |
CVE-2022-41351 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/12/2022 | SeverityMedium |
CVE-2022-41349 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/12/2022 | SeverityMedium |
CVE-2022-41348 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/12/2022 | SeverityMedium |
CVE-2022-41350 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/12/2022 | SeverityMedium |
CVE-2022-41347 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/26/2022 | SeverityHigh |
CVE-2022-37393Zimbra zmslapd arbitrary module load | Exploitation statusNot confirmed | FixNot confirmed | Affected productZimbra Server | Published08/16/2022 | SeverityUnknown |
CVE-2022-37044 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/11/2022 | SeverityUnknown |
CVE-2022-37043 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/11/2022 | SeverityUnknown |
CVE-2022-37041 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/11/2022 | SeverityUnknown |
CVE-2022-32294 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/11/2022 | SeverityUnknown |
CVE-2021-35207 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/02/2021 | SeverityUnknown |
CVE-2021-35208 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/02/2021 | SeverityUnknown |
CVE-2021-35209 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/02/2021 | SeverityUnknown |
CVE-2021-34807 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/02/2021 | SeverityUnknown |
CVE-2020-35123 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published12/17/2020 | SeverityUnknown |
CVE-2020-11737 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published05/05/2020 | SeverityUnknown |
CVE-2020-10194 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/20/2020 | SeverityUnknown |
CVE-2013-1938 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZimbra | Published02/12/2020 | SeverityUnknown |
CVE-2019-8945 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2020 | SeverityUnknown |
CVE-2019-8946 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2020 | SeverityUnknown |
CVE-2019-8947 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2020 | SeverityUnknown |
CVE-2019-12427 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2020 | SeverityUnknown |
CVE-2019-15313 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2020 | SeverityUnknown |
CVE-2015-7610 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/30/2018 | SeverityUnknown |
CVE-2018-10939 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/30/2018 | SeverityUnknown |
CVE-2016-5721 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/29/2016 | SeverityUnknown |
CVE-2015-6541 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published04/08/2016 | SeverityUnknown |
CVE-2013-7217 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/26/2013 | SeverityUnknown |
CVE-2012-1213 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/20/2012 | SeverityUnknown |
CVE-2008-1226 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/10/2008 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan