Zimbra Patches Six Security Flaws, Including a Bug That Lets Strangers Run Commands on Your Email Server
The business email platform Zimbra has released a batch of fixes covering a serious command-injection flaw and five other vulnerabilities. No attacks in the wild have been confirmed, but the company is urging every customer to update immediately.
Key points
- Zimbra released version 10.1.20 of its Collaboration Suite on Monday, patching six security vulnerabilities of varying severity.
- The most serious flaw lets an unauthenticated attacker, someone with no login credentials at all, run arbitrary commands on a Zimbra email server.
- CVE-2026-50055 allowed a logged-in user to quietly forward emails out of an organisation even when forwarding rules were supposed to block that.
- Zimbra says none of the six flaws have been exploited in attacks yet, but has released no technical details to help defenders prioritise.
- Organisations running Zimbra should update to version 10.1.20 as soon as possible.
Zimbra Collaboration Suite, a platform that companies use to run their own email and calendar systems, shipped a batch of security fixes on Monday. Six vulnerabilities were addressed. One is serious enough to give a complete stranger control over the underlying server.
The headline flaw sits in a component called SNMP, which stands for Simple Network Management Protocol, a standard tool that lets administrators monitor the health of a system remotely. When SNMP notifications are switched on and a related background service called Swatchdog is running, an attacker with no account and no password can send a crafted message that tricks the server into executing any operating-system command they choose. A criminal on the internet could tell the server to do almost anything, from copying out stored emails to dropping further malicious software. Zimbra disclosed the flaw in late June, and the permanent fix arrived in version 10.1.20.
This update lands roughly two weeks after Zimbra patched a critical cross-site scripting bug in its Classic Web Client that could hijack a user's session the moment a rigged email was opened, a pattern worth watching: two critical patches inside a month for the same platform.
How did the other five flaws work?
Four of the remaining bugs are cross-site scripting flaws, where malicious code hidden inside a crafted attachment or filename runs inside a victim's browser when they open or preview the message. CVE-2026-50055 is a mail-forwarding bypass: a logged-in employee, or someone who'd stolen an employee's password, could silently redirect company emails to an outside address even if the organisation had locked down that setting as policy.
The update also closes an access-control gap in the EWS extension (CVE-2026-10631, where EWS is a programming interface for connecting third-party apps to the mailbox), an authorisation problem in mailbox delegation (CVE-2026-50054, which controls who can read or send email on someone else's behalf), and a server-side request forgery bug in the Nextcloud file-storage integration. Server-side request forgery is a technique where an attacker tricks a server into making internal network requests on their behalf, potentially exposing systems that shouldn't be reachable from outside.
Should you worry?
Zimbra hasn't published technical details for any of the six issues, and reports no evidence of active exploitation. Gaps between disclosure and exploitation have narrowed sharply over recent years, though, so the absence of known attacks today isn't a reason to delay. Update to version 10.1.20. If you receive email through a provider running Zimbra on your behalf, confirm they've applied it. Either way, check your account's email-forwarding rules now: it's a two-minute check that any employee can do without IT help.
