--- title: "Zimbra zm-mailbox vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/zimbra/zm-mailbox type: product description: "Zimbra zm-mailbox has 19 published CVEs, 5 in CISA KEV and 6 with public exploits." updated: 2026-10-23 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Zimbra zm-mailbox vulnerabilities Vendor: [Zimbra](https://radicalnotion.ai/vendor/zimbra) - **Published CVEs:** 19 - **In CISA KEV:** 5 - **With a public exploit:** 6 - **With a patch:** 15 - **Average CVSS:** 6.8 - **First CVE:** 2018-03-27 - **Latest CVE:** 2026-10-23 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 7 | | Medium | 11 | | Low | 1 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 5 | | [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 2 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | | [CWE-24](https://radicalnotion.ai/cwe/cwe-24) | Path Traversal: '../filedir' | 1 | | [CWE-642](https://radicalnotion.ai/cwe/cwe-642) | External Control of Critical State Data | 1 | | [CWE-669](https://radicalnotion.ai/cwe/cwe-669) | Incorrect Resource Transfer Between Spheres | 1 | | [CWE-74](https://radicalnotion.ai/cwe/cwe-74) | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1 | | [CWE-829](https://radicalnotion.ai/cwe/cwe-829) | Inclusion of Functionality from Untrusted Control Sphere | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2018 | 1 | | 2019 | 0 | | 2020 | 1 | | 2021 | 0 | | 2022 | 3 | | 2023 | 0 | | 2024 | 1 | | 2025 | 4 | | 2026 | 9 | ## Affected versions (top 15 of 100) | Version | Kind | CVEs | | --- | --- | --- | | 10.1.0 | exact | 10 | | 10.1.1 | exact | 10 | | 10.1.2 | exact | 10 | | 10.1.10 | exact | 9 | | 10.1.3 | exact | 9 | | 10.1.4 | exact | 9 | | 10.1.5 | exact | 9 | | 10.1.6 | exact | 9 | | 10.1.7 | exact | 9 | | 10.1.8 | exact | 9 | | 10.1.13 | exact | 8 | | 10.1.14 | exact | 8 | | \< 8.8.15 | range | 1 | | 8.8.15 | range | 1 | | 8.8.15 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-93638 | Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter | medium | 6.1 | No | Yes | No | | CVE-2026-50053 | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters | high | 8.7 | No | No | No | | CVE-2026-73576 | In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability... | medium | 6.5 | No | No | Yes | | CVE-2026-73575 | In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability... | low | 3.5 | No | No | Yes | | CVE-2026-73574 | In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the... | medium | 6.5 | No | No | Yes | | CVE-2026-73573 | In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra... | medium | 6.5 | No | No | Yes | | CVE-2026-73572 | In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability... | medium | 6.1 | No | No | Yes | | CVE-2026-73571 | An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to... | medium | 4.3 | No | No | Yes | | CVE-2026-33373 | - | high | 8.8 | No | No | Yes | | CVE-2025-48700 | - | high | 8.5 | Yes | Yes | Yes | | CVE-2024-45516 | - | medium | 6.1 | No | No | Yes | | CVE-2025-25065 | - | medium | 5.3 | No | No | Yes | | CVE-2025-25064 | - | high | 8.8 | No | No | Yes | | CVE-2024-54663 | - | high | 7.5 | No | No | Yes | | CVE-2022-27925 | - | high | 8.6 | Yes | Yes | No | | CVE-2022-27924 | - | high | 8.7 | Yes | Yes | No | | CVE-2022-24682 | - | medium | 6.4 | Yes | Yes | Yes | | CVE-2020-10194 | - | medium | 6.5 | No | No | Yes | | CVE-2018-6882 | - | medium | 6.3 | Yes | Yes | Yes | ## Frequently asked questions ### How many CVEs does Zimbra zm-mailbox have? Zimbra zm-mailbox has 19 published CVE records since 2018. ### How many Zimbra zm-mailbox CVEs are in CISA KEV? 5 of Zimbra zm-mailbox's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline. ### Are there public exploits for Zimbra zm-mailbox vulnerabilities? Yes — 6 of Zimbra zm-mailbox's CVEs have a known public exploit. ### Which versions of Zimbra zm-mailbox are affected? 100 distinct Zimbra zm-mailbox versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Zimbra zm-mailbox CVEs? Zimbra zm-mailbox's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-24 (Path Traversal: '../filedir'). ### What is the average severity of Zimbra zm-mailbox CVEs? The average CVSS base score across Zimbra zm-mailbox's scored CVEs is 6.8. ## Other products from this vendor - [zm-build](https://radicalnotion.ai/vendor/zimbra/zm-build) (114 CVEs) - [Collaboration](https://radicalnotion.ai/vendor/zimbra/collaboration) (50 CVEs) - [Zimbra Collaboration Suite](https://radicalnotion.ai/vendor/zimbra/zimbra-collaboration-suite) (25 CVEs) - [zm-zcs-lib](https://radicalnotion.ai/vendor/zimbra/zm-zcs-lib) (12 CVEs) - [zm-zcs](https://radicalnotion.ai/vendor/zimbra/zm-zcs) (11 CVEs) - [Zimbra Collaboration Suite (ZCS)](https://radicalnotion.ai/vendor/zimbra/zimbra-collaboration-suite-zcs) (7 CVEs) - [collaboration server](https://radicalnotion.ai/vendor/zimbra/collaboration-server) (6 CVEs) - [Zimbra](https://radicalnotion.ai/vendor/zimbra/zimbra) (5 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/zimbra/zm-mailbox). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.