SecAlerts
Z

Zimbra

Security Risk Profile

43
/100
medium

Security Risk Score

Comprehensive risk assessment based on 142 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from March 10, 2008 to present

142
Total CVEs
46
Critical+High
7
Exploited
42
Unpatched

Threat Assessment

Avg CVSS
6.7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
42
Critical/High
Risk Level
43/100
medium
⚠️ 7 Active Exploits⚡ 7 Zero-Days🆕 17Fresh (<7d)📈 22 in Last 30 Days

Severity Distribution

Critical
16
High
30
Medium
83
Low
3

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
10

Age Distribution

Common Weaknesses (CWE)

1
XSS
60
2
CSRF
13
3
Path Traversal
6
4
SSRF
6
5
Command Injection
5

Most Affected Products

1. Zimbra Collaboration1560
2. Synacor Zimbra Collaboration Suite1138
3. Zimbra Zimbra74
4. Zimbra Collaboration Server67
5. Zimbra Zimbra Collaboration Suite35

Recent Vulnerabilities

See more →
CVE-2026-115786
CVSS 6.5medium

Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion

Oct 23, 2026🔧 No Patch
CVE-2026-115785
CVSS 4.3medium

Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address

Oct 23, 2026🔧 No Patch
CVE-2026-93640
CVSS 7.8high

Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration

Oct 23, 2026🔧 No Patch
CVE-2026-50057
CVSS 7.8high

Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions

Oct 23, 2026🔧 No Patch
CVE-2026-50056
CVSS 7.8high

Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection

Oct 23, 2026🔧 No Patch
CVE-2026-93639
CVSS 8.7high

Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation

Oct 23, 2026🔧 No Patch
CVE-2026-93638
CVSS 6.1medium

Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter

Oct 23, 2026🔧 No Patch
CVE-2026-93636
CVSS 4.3medium

Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name

Oct 23, 2026🔧 No Patch
CVE-2026-93634
CVSS 4.3medium

Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records

Oct 23, 2026🔧 No Patch
CVE-2026-93633
CVSS 5.4medium

Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters

Oct 23, 2026🔧 No Patch

Monitor Zimbra in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

Zimbra Security Vulnerabilities & Risk Score | 142 CVEs | SecAlerts - SecAlerts