Browse all 17 CVE security advisories affecting Zimbra. AI-powered Chinese analysis, POCs, and references for each vulnerability.
Zimbra serves as a collaborative email and calendaring platform, primarily used by organizations for unified communication. Historically, it has been susceptible to various vulnerabilities including remote code execution, cross-site scripting, and privilege escalation, often stemming from input validation flaws and insecure default configurations. The platform's complex architecture and extensive feature set have contributed to security challenges, with past incidents involving unauthorized access and data breaches. Despite these issues, Zimbra remains widely deployed, necessitating regular security updates and hardening to mitigate risks associated with its known CVE history.
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-93647 | Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address — Zimbra Collaboration Suite (ZCS) CWE-79 | 9.3 | Critical | 2026-09-25 |
| CVE-2026-93643 | Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request — Zimbra Collaboration Suite (ZCS) CWE-22 | 9.8 | Critical | 2026-09-25 |
| CVE-2026-93642 | Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation — Zimbra Collaboration Suite (ZCS) CWE-79 | 9.3 | Critical | 2026-09-25 |
| CVE-2026-93641 | Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation — Zimbra Collaboration Suite (ZCS) CWE-79 | 9.3 | Critical | 2026-09-25 |
This page lists every published CVE security advisory associated with Zimbra. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.