How many Zimbra Collaboration Suite (ZCS) CVEs are in CISA KEV?

3 of Zimbra Collaboration Suite (ZCS)'s CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of Zimbra Collaboration Suite (ZCS) are affected?

2 distinct Zimbra Collaboration Suite (ZCS) versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Zimbra Collaboration Suite (ZCS) CVEs?

Zimbra Collaboration Suite (ZCS)'s CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-918 (Server-Side Request Forgery (SSRF)).

How many critical Zimbra Collaboration Suite (ZCS) vulnerabilities are there?

Zimbra Collaboration Suite (ZCS) has 6 critical and 0 high-severity CVEs.

What is the average severity of Zimbra Collaboration Suite (ZCS) CVEs?

The average CVSS base score across Zimbra Collaboration Suite (ZCS)'s scored CVEs is 8.9.

Zimbra Collaboration Suite (ZCS) Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Zimbra Collaboration Suite (ZCS) vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

Zimbra Collaboration Suite (ZCS) has 7 published CVE records since 2018, of which 3 are in CISA's Known Exploited Vulnerabilities catalog and 3 have a known public exploit. The average CVSS base score across scored CVEs is 8.9.

Severity and exploitation

How the CVSS severity of Zimbra Collaboration Suite (ZCS)'s CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical6

High0

Medium1

Low0

In CISA’s Known Exploited Vulnerabilities catalog

3 of Zimbra Collaboration Suite (ZCS)'s CVEs are confirmed exploited in the wild.

Public exploits

3 of Zimbra Collaboration Suite (ZCS)'s CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Zimbra Collaboration Suite (ZCS) version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 10.1.214 CVEs

Fixed in

10.1.214 CVEs

Find a version

7 CVEs

Sort

Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address
CVE-2026-93647
Patch
CWE-79
Critical · CVSS 9.3
EPSS 0.2% (14th pct)2026-09-25
Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request
CVE-2026-93643
Patch
CWE-22
Critical · CVSS 9.8
EPSS 1.0% (62th pct)2026-09-25
Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation
CVE-2026-93642
Patch
CWE-79
Critical · CVSS 9.3
EPSS 0.2% (14th pct)2026-09-25
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
CVE-2026-93641
Patch
CWE-79
Critical · CVSS 9.3
EPSS 0.3% (20th pct)2026-09-25
Critical vulnerability · 2024-10-02
CVE-2024-45519
CISA KEV
Public exploit
Patch
CWE-78
Added to CISA KEV 2024-10-03
Critical · CVSS 9.3
EPSS 99.9% (100th pct)2024-10-02
Critical vulnerability · 2020-02-18
CVE-2020-7796
CISA KEV
Public exploit
Patch
CWE-918
Added to CISA KEV 2026-02-17
Critical · CVSS 9.3
EPSS 93.6% (100th pct)2020-02-18
Medium vulnerability · 2018-03-27
CVE-2018-6882
CISA KEV
Public exploit
Patch
CWE-79
Added to CISA KEV 2022-04-19
Medium · CVSS 6.3
EPSS 29.8% (98th pct)2018-03-27

Common weakness types

The CWE weakness categories most often found in Zimbra Collaboration Suite (ZCS) CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Zimbra Collaboration Suite (ZCS) CVEs were published each year.

2018

2019

2020

2021

2022

2023

2024

Other Zimbra products

Browse vulnerabilities for other products by Zimbra.

zm-build114 CVEs Collaboration50 CVEs Zimbra Collaboration Suite25 CVEs zm-mailbox19 CVEs zm-zcs-lib12 CVEs zm-zcs11 CVEs collaboration server6 CVEs

Frequently asked questions

Common questions about Zimbra Collaboration Suite (ZCS) vulnerabilities.

How many CVEs does Zimbra Collaboration Suite (ZCS) have?: Zimbra Collaboration Suite (ZCS) has 7 published CVE records since 2018.
How many Zimbra Collaboration Suite (ZCS) CVEs are in CISA KEV?: 3 of Zimbra Collaboration Suite (ZCS)'s CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Zimbra Collaboration Suite (ZCS) vulnerabilities?: Yes — 3 of Zimbra Collaboration Suite (ZCS)'s CVEs have a known public exploit.
Which versions of Zimbra Collaboration Suite (ZCS) are affected?: 2 distinct Zimbra Collaboration Suite (ZCS) versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Zimbra Collaboration Suite (ZCS) CVEs?: Zimbra Collaboration Suite (ZCS)'s CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-918 (Server-Side Request Forgery (SSRF)).
How many critical Zimbra Collaboration Suite (ZCS) vulnerabilities are there?: Zimbra Collaboration Suite (ZCS) has 6 critical and 0 high-severity CVEs.
What is the average severity of Zimbra Collaboration Suite (ZCS) CVEs?: The average CVSS base score across Zimbra Collaboration Suite (ZCS)'s scored CVEs is 8.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Zimbra Collaboration Suite (ZCS) vulnerabilities

Get an alert for each new Zimbra Collaboration Suite (ZCS) CVE, with AI-written analysis and remediation steps.

Create an account See pricing