---
title: "Zimbra zm-build vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/zimbra/zm-build
type: product
description: "Zimbra zm-build has 114 published CVEs, 19 in CISA KEV and 30 with public exploits."
updated: 2026-10-23
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Zimbra zm-build vulnerabilities

Vendor: [Zimbra](https://radicalnotion.ai/vendor/zimbra)

- **Published CVEs:** 114
- **In CISA KEV:** 19
- **With a public exploit:** 30
- **With a patch:** 72
- **Average CVSS:** 6.8
- **First CVE:** 2017-05-23
- **Latest CVE:** 2026-10-23

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 16 |
| High | 23 |
| Medium | 75 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 54 |
| [CWE-918](https://radicalnotion.ai/cwe/cwe-918) | Server-Side Request Forgery (SSRF) | 7 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 6 |
| [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 5 |
| [CWE-611](https://radicalnotion.ai/cwe/cwe-611) | Improper Restriction of XML External Entity Reference | 4 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 3 |
| [CWE-601](https://radicalnotion.ai/cwe/cwe-601) | URL Redirection to Untrusted Site ('Open Redirect') | 3 |
| [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 2 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2017 | 2 |
| 2018 | 8 |
| 2019 | 10 |
| 2020 | 11 |
| 2021 | 6 |
| 2022 | 18 |
| 2023 | 14 |
| 2024 | 21 |
| 2025 | 10 |
| 2026 | 14 |

## Affected versions (top 31 of 285)

| Version | Kind | CVEs |
| --- | --- | --- |
| 8.8.2 | exact | 78 |
| 8.8.3 | exact | 77 |
| 8.8.4 | exact | 77 |
| 8.8.6 | exact | 77 |
| 8.7.6 | exact | 76 |
| 8.7.7 | exact | 76 |
| 8.8.7 | exact | 76 |
| 8.7.9 | exact | 74 |
| 8.7.10 | exact | 73 |
| 8.7.11 | exact | 73 |
| 8.8.8 | exact | 73 |
| 8.8.0.beta1 | exact | 72 |
| \<= 9.0.0-p12 | range | 38 |
| \<= 9.0.0-p15 | range | 37 |
| \<= 9.0.0-p21 | range | 32 |
| \<= 8.8.15-p19 | range | 27 |
| \<= 8.8.15-p22 | range | 26 |
| \<= 9.0.0-p2 | range | 25 |
| \<= 9.0.0-p3 | range | 25 |
| \<= 9.0.0-p5 | range | 25 |
| \<= 9.0.0-p6 | range | 25 |
| \<= 9.0.0-p8 | range | 25 |
| \<= 9.0.0-p9 | range | 25 |
| \<= 9.0.0-p10 | range | 24 |
| 10.0.8 | patched | 3 |
| 10.0.7 | patched | 2 |
| 10.0.10 | patched | 1 |
| 10.0.11 | patched | 1 |
| 10.0.3 | patched | 1 |
| 10.1.2 | patched | 1 |
| 8.6.0 | patched | 1 |

## CVEs (first 30 of 114, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-115786 | Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion | medium | 6.5 | No | No | No |
| CVE-2026-115785 | Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address | medium | 4.3 | No | No | No |
| CVE-2026-93636 | Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name | medium | 4.3 | No | Yes | No |
| CVE-2026-93634 | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records | medium | 4.3 | No | Yes | No |
| CVE-2026-93633 | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters | medium | 5.4 | No | Yes | No |
| CVE-2026-93631 | Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking | high | 7.1 | No | Yes | No |
| CVE-2026-73570 | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when... | high | 8.9 | Yes | Yes | Yes |
| CVE-2026-33373 | - | high | 8.8 | No | No | Yes |
| CVE-2026-33372 | - | medium | 5.4 | No | No | Yes |
| CVE-2026-33371 | - | medium | 4.3 | No | No | Yes |
| CVE-2026-33370 | - | medium | 6.1 | No | No | Yes |
| CVE-2026-33369 | - | medium | 4.3 | No | No | Yes |
| CVE-2026-33368 | - | medium | 6.1 | No | No | Yes |
| CVE-2025-66376 | - | medium | 5.3 | Yes | Yes | Yes |
| CVE-2025-68645 | - | critical | 9.3 | Yes | Yes | Yes |
| CVE-2025-67809 | - | medium | 4.7 | No | No | Yes |
| CVE-2024-45515 | - | medium | 6.1 | No | No | No |
| CVE-2025-48700 | - | high | 8.5 | Yes | Yes | Yes |
| CVE-2024-45516 | - | medium | 6.1 | No | No | Yes |
| CVE-2025-32354 | - | high | 8.8 | No | No | Yes |
| CVE-2025-27915 | - | high | 8.6 | Yes | Yes | Yes |
| CVE-2025-27914 | - | medium | 5.4 | No | No | Yes |
| CVE-2025-25065 | - | medium | 5.3 | No | No | Yes |
| CVE-2025-25064 | - | high | 8.8 | No | No | Yes |
| CVE-2024-9665 | Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability | medium | 6.5 | No | No | Yes |
| CVE-2024-45517 | - | medium | 6.1 | No | No | Yes |
| CVE-2024-45514 | - | medium | 6.1 | No | No | Yes |
| CVE-2024-45513 | - | medium | 4.8 | No | No | Yes |
| CVE-2024-45512 | - | medium | 6.1 | No | No | Yes |
| CVE-2024-45194 | - | medium | 4.8 | No | No | Yes |

## Frequently asked questions

### How many CVEs does Zimbra zm-build have?

Zimbra zm-build has 114 published CVE records since 2017.

### How many Zimbra zm-build CVEs are in CISA KEV?

19 of Zimbra zm-build's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

### Are there public exploits for Zimbra zm-build vulnerabilities?

Yes — 30 of Zimbra zm-build's CVEs have a known public exploit.

### Which versions of Zimbra zm-build are affected?

285 distinct Zimbra zm-build versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Zimbra zm-build CVEs?

Zimbra zm-build's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

### How many critical Zimbra zm-build vulnerabilities are there?

Zimbra zm-build has 16 critical and 23 high-severity CVEs.

### What is the average severity of Zimbra zm-build CVEs?

The average CVSS base score across Zimbra zm-build's scored CVEs is 6.8.

## Other products from this vendor

- [Collaboration](https://radicalnotion.ai/vendor/zimbra/collaboration) (50 CVEs)
- [Zimbra Collaboration Suite](https://radicalnotion.ai/vendor/zimbra/zimbra-collaboration-suite) (25 CVEs)
- [zm-mailbox](https://radicalnotion.ai/vendor/zimbra/zm-mailbox) (19 CVEs)
- [zm-zcs-lib](https://radicalnotion.ai/vendor/zimbra/zm-zcs-lib) (12 CVEs)
- [zm-zcs](https://radicalnotion.ai/vendor/zimbra/zm-zcs) (11 CVEs)
- [Zimbra Collaboration Suite (ZCS)](https://radicalnotion.ai/vendor/zimbra/zimbra-collaboration-suite-zcs) (7 CVEs)
- [collaboration server](https://radicalnotion.ai/vendor/zimbra/collaboration-server) (6 CVEs)
- [Zimbra](https://radicalnotion.ai/vendor/zimbra/zimbra) (5 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/zimbra/zm-build). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.