How many CVEs does Zimbra have?

Zimbra has 122 published CVE records since 2008, including 21 in the last two years.

How many Zimbra CVEs are in CISA KEV?

Yes — 18 of Zimbra's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Zimbra products have the most CVEs?

The Zimbra products with the most published CVEs are zm-build, Collaboration, zm-mailbox, collaboration server, Zimbra.

What are the most common weakness types in Zimbra CVEs?

Zimbra's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

Are there public exploits for Zimbra vulnerabilities?

Yes — 26 of Zimbra's CVEs have a known public exploit.

How many critical Zimbra vulnerabilities are there?

Zimbra has 18 critical and 25 high-severity CVEs.

What is the average severity of Zimbra CVEs?

The average CVSS base score across Zimbra's scored CVEs is 6.8.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

122 CVEs

18 in CISA KEV

Zimbra Vulnerabilities

Name: Zimbra vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Zimbra.

122

Total CVEs

Published

18

In CISA KEV

Exploited in the wild

26

Public exploits

PoC or exploit code

6.8

Avg CVSS

2008–2026

Overview

Zimbra has 122 published CVE records since 2008, of which 18 are in CISA's Known Exploited Vulnerabilities catalog and 26 have a known public exploit. The average CVSS base score across scored CVEs is 6.8.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Zimbra products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Zimbra's vulnerability posture, as a share of its 122 published CVEs.

Average CVSS: 6.8
Critical / high: 35%
Actively exploited (KEV): 15%
Public exploit available: 21%
Patch available: 63%

Severity and exploitation

How the CVSS severity of Zimbra's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical18

High25

Medium78

Low1

In CISA’s Known Exploited Vulnerabilities catalog

18

18 of Zimbra's CVEs are confirmed exploited in the wild.

Public exploits

26

26 of Zimbra's CVEs have a known public exploit available.

Most affected products

The Zimbra products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Zimbra CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Zimbra CVE records.

Disclosure activity by year

How many Zimbra CVEs were published each year.

2019

10

2020

13

2021

6

2022

18

2023

14

2024

24

2025

14

2026

7

Latest Zimbra CVEs

The most recently disclosed vulnerabilities affecting Zimbra.

High vulnerability · 2026-03-30
CWE-352
High · CVSS 8.8
EPSS 0.2%2026-03-30
Medium vulnerability · 2026-03-20
CWE-352
Medium · CVSS 5.4
EPSS 0.1%2026-03-20
Medium vulnerability · 2026-03-20
CWE-20
Medium · CVSS 4.3
EPSS 0.2%2026-03-20
Medium vulnerability · 2026-03-20
CWE-79
Medium · CVSS 6.1
EPSS 0.2%2026-03-20
Medium vulnerability · 2026-03-20
CWE-611
Medium · CVSS 4.3
EPSS 0.2%2026-03-20
Medium vulnerability · 2026-03-20
CWE-79
Medium · CVSS 6.1
EPSS 0.2%2026-03-20
Medium vulnerability · 2026-01-05
CISA KEV
CWE-79
Medium · CVSS 5.3
EPSS 21.6%2026-01-05
Critical vulnerability · 2025-12-22
CISA KEV
CWE-98
Critical · CVSS 9.3
EPSS 31.8%2025-12-22
Medium vulnerability · 2025-12-15
CWE-798
Medium · CVSS 4.7
EPSS 0.2%2025-12-15
Medium vulnerability · 2025-10-21
CWE-918
Medium · CVSS 5.0
EPSS 0.2%2025-10-21
Medium vulnerability · 2025-09-17
CWE-352
Medium · CVSS 6.3
EPSS 0.2%2025-09-17
Critical vulnerability · 2025-09-16
CWE-284
Critical · CVSS 9.1
EPSS 0.6%2025-09-16

Track new Zimbra CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Zimbra CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Philips124 CVEs F-Secure123 CVEs getgrav123 CVEs automattic121 CVEs Bosch121 CVEs GraphicsMagick121 CVEs Insyde121 CVEs themeisle121 CVEs

Browse all vendors

Frequently asked questions

Common questions about Zimbra vulnerabilities.

How many CVEs does Zimbra have?: Zimbra has 122 published CVE records since 2008, including 21 in the last two years.
How many Zimbra CVEs are in CISA KEV?: Yes — 18 of Zimbra's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Zimbra products have the most CVEs?: The Zimbra products with the most published CVEs are zm-build, Collaboration, zm-mailbox, collaboration server, Zimbra.
What are the most common weakness types in Zimbra CVEs?: Zimbra's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).
Are there public exploits for Zimbra vulnerabilities?: Yes — 26 of Zimbra's CVEs have a known public exploit.
How many critical Zimbra vulnerabilities are there?: Zimbra has 18 critical and 25 high-severity CVEs.
What is the average severity of Zimbra CVEs?: The average CVSS base score across Zimbra's scored CVEs is 6.8.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Zimbra vulnerabilities

Monitor new Zimbra vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing