---
title: "Zimbra vulnerabilities: CVEs, CISA KEV and security advisories"
url: https://radicalnotion.ai/vendor/zimbra
type: vendor
description: "Zimbra has 155 published CVEs, 19 in CISA KEV and 34 with public exploits."
updated: 2026-10-23
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Zimbra vulnerabilities

- **Published CVEs:** 155
- **In CISA KEV:** 19
- **With a public exploit:** 34
- **With a patch:** 92
- **Average CVSS:** 6.8
- **CVEs in the last two years:** 54
- **First CVE:** 2008-03-10
- **Latest CVE:** 2026-10-23

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 22 |
| High | 34 |
| Medium | 96 |
| Low | 3 |
| Unscored | 0 |

## Most affected products

| Product | CVEs |
| --- | --- |
| [zm-build](https://radicalnotion.ai/vendor/zimbra/zm-build) | 114 |
| [Collaboration](https://radicalnotion.ai/vendor/zimbra/collaboration) | 50 |
| [Zimbra Collaboration Suite](https://radicalnotion.ai/vendor/zimbra/zimbra-collaboration-suite) | 25 |
| [zm-mailbox](https://radicalnotion.ai/vendor/zimbra/zm-mailbox) | 19 |
| [zm-zcs-lib](https://radicalnotion.ai/vendor/zimbra/zm-zcs-lib) | 12 |
| [zm-zcs](https://radicalnotion.ai/vendor/zimbra/zm-zcs) | 11 |
| [Zimbra Collaboration Suite (ZCS)](https://radicalnotion.ai/vendor/zimbra/zimbra-collaboration-suite-zcs) | 7 |
| [collaboration server](https://radicalnotion.ai/vendor/zimbra/collaboration-server) | 6 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 66 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 10 |
| [CWE-918](https://radicalnotion.ai/cwe/cwe-918) | Server-Side Request Forgery (SSRF) | 8 |
| [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 6 |
| [CWE-611](https://radicalnotion.ai/cwe/cwe-611) | Improper Restriction of XML External Entity Reference | 4 |
| [CWE-863](https://radicalnotion.ai/cwe/cwe-863) | Incorrect Authorization | 4 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 3 |
| [CWE-290](https://radicalnotion.ai/cwe/cwe-290) | Authentication Bypass by Spoofing | 3 |

## Assigning CNAs

| CNA | CVEs |
| --- | --- |
| [mitre](https://radicalnotion.ai/cna/mitre) | 123 |
| [rapid7](https://radicalnotion.ai/cna/rapid7) | 28 |
| [VulDB](https://radicalnotion.ai/cna/vuldb) | 2 |
| [redhat](https://radicalnotion.ai/cna/redhat) | 1 |
| [zdi](https://radicalnotion.ai/cna/zdi) | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2019 | 10 |
| 2020 | 13 |
| 2021 | 6 |
| 2022 | 18 |
| 2023 | 14 |
| 2024 | 24 |
| 2025 | 14 |
| 2026 | 40 |

## Latest CVEs

| CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-115786 | Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion | medium | 6.5 | 0.4% | No | 2026-10-23 |
| CVE-2026-115785 | Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address | medium | 4.3 | 0.7% | No | 2026-10-23 |
| CVE-2026-93640 | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration | high | 7.8 | 0.1% | No | 2026-10-23 |
| CVE-2026-50057 | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions | high | 7.8 | 0.3% | No | 2026-10-23 |
| CVE-2026-50056 | Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection | high | 7.8 | 0.3% | No | 2026-10-23 |
| CVE-2026-93639 | Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation | high | 8.7 | 0.4% | No | 2026-10-23 |
| CVE-2026-93638 | Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter | medium | 6.1 | 0.3% | No | 2026-10-23 |
| CVE-2026-93636 | Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name | medium | 4.3 | 0.3% | No | 2026-10-23 |
| CVE-2026-93634 | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records | medium | 4.3 | 0.3% | No | 2026-10-23 |
| CVE-2026-93633 | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters | medium | 5.4 | 0.2% | No | 2026-10-23 |
| CVE-2026-93631 | Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking | high | 7.1 | 0.2% | No | 2026-10-23 |
| CVE-2026-93630 | Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization | medium | 4.3 | 0.3% | No | 2026-10-23 |

## Frequently asked questions

### How many CVEs does Zimbra have?

Zimbra has 155 published CVE records since 2008, including 54 in the last two years.

### How many Zimbra CVEs are in CISA KEV?

19 of Zimbra's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

### Which Zimbra products have the most CVEs?

The Zimbra products with the most published CVEs are zm-build, Collaboration, Zimbra Collaboration Suite, zm-mailbox, zm-zcs-lib.

### What are the most common weakness types in Zimbra CVEs?

Zimbra's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

### Are there public exploits for Zimbra vulnerabilities?

Yes — 34 of Zimbra's CVEs have a known public exploit.

### How many critical Zimbra vulnerabilities are there?

Zimbra has 22 critical and 34 high-severity CVEs.

### What is the average severity of Zimbra CVEs?

The average CVSS base score across Zimbra's scored CVEs is 6.8.

## Related vendors

- [F5 Networks](https://radicalnotion.ai/vendor/f5networks) (157 CVEs)
- [Cesanta](https://radicalnotion.ai/vendor/cesanta) (157 CVEs)
- [axiosys](https://radicalnotion.ai/vendor/axiosys) (156 CVEs)
- [ThimPress](https://radicalnotion.ai/vendor/thimpress) (156 CVEs)
- [Prestashop](https://radicalnotion.ai/vendor/prestashop) (155 CVEs)
- [Ubiquiti](https://radicalnotion.ai/vendor/ubiquiti) (154 CVEs)
- [Mitel](https://radicalnotion.ai/vendor/mitel) (153 CVEs)
- [Squid Cache](https://radicalnotion.ai/vendor/squid-cache) (153 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/zimbra). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.