VYPR
advisoryPublished Oct 23, 2026· Updated Oct 24, 2026· 1 source

Zimbra Collaboration Suite: 17 Vulnerabilities Disclosed Together, Ranging High to Medium Severity

Key findings • 17 vulnerabilities disclosed simultaneously for Zimbra Collaboration Suite on October 23, 2026. • High-severity privilege escalation flaws allow 'zimbra' user to achieve root a…

Key findings

  • 17 vulnerabilities disclosed simultaneously for Zimbra Collaboration Suite on October 23, 2026.
  • High-severity privilege escalation flaws allow 'zimbra' user to achieve root access.
  • Multiple authorization bypass and injection vulnerabilities impact system integrity and data security.
  • Cross-site scripting and calendar manipulation flaws affect user interaction and meeting management.
  • Patches are available; Zimbra administrators must update systems promptly.

On October 23, 2026, a significant batch of 17 vulnerabilities was disclosed for Zimbra Collaboration Suite (ZCS), spanning multiple components and severity levels. These vulnerabilities, all disclosed on the same day, highlight a range of security weaknesses including privilege escalation, authorization bypass, cross-site scripting, and injection flaws. The sheer volume and variety of these issues underscore the importance of timely patching and security diligence for Zimbra administrators.

Several vulnerabilities focus on privilege escalation. CVE-2026-93640 and CVE-2026-50057, both rated High (CVSSv3 7.8), exploit weak sudo policies in the optional dnscache package and the MTA package, respectively, allowing the 'zimbra' user to gain root privileges. Similarly, CVE-2026-50056 (High, CVSSv3 7.8) leverages an improperly secured zmmailboxdmgr launcher, enabling the 'zimbra' account to execute arbitrary commands as root by manipulating JVM arguments.

Authorization and authentication flaws are also prominent. CVE-2026-93639 (High, CVSSv3 8.7) and CVE-2026-50053 (High, CVSSv3 8.7) represent critical security gaps. The former allows a delegated administrator with minimal privileges to overwrite global Zimlet configurations, potentially adding attacker-controlled domains to proxy allowlists. The latter permits unauthenticated requests to bypass security filters, enabling the population of sensitive servlet attributes. Further authorization issues include CVE-2026-93634 (Medium, CVSSv3 4.3), which allows authenticated users to forge shared-file records in other mailboxes, and CVE-2026-93631 (High, CVSSv3 7.1), a CSRF vulnerability in the OAuth extension enabling account linking.

Cross-site scripting (XSS) vulnerabilities were identified in multiple areas. CVE-2026-93638 (Medium, CVSSv3 6.1) affects the login page, allowing unauthenticated attackers to execute JavaScript via the zrememberme parameter. A more severe XSS flaw, CVE-2026-10632 (High, CVSSv3 8.7), impacts the Classic Web Client's document editor, enabling JavaScript injection through the packages parameter. Additionally, CVE-2026-93633 (Medium, CVSSv3 5.4) involves a CSS sanitization issue in the Briefcase feature, allowing authenticated users to publish content that displays attacker-controlled information under the Zimbra origin.

Injection vulnerabilities present another significant risk. CVE-2026-93630 (Medium, CVSSv3 4.3) involves hostname canonicalization issues in email HTML sanitizers, allowing unauthenticated senders to bypass restrictions on forms targeting the Zimbra host. CVE-2026-93636 (Medium, CVSSv3 4.3) is an LDAP filter injection vulnerability that enables authenticated users to query sensitive calendar resource attributes. Furthermore, CVE-2026-115785 (Medium, CVSSv3 4.3) is an SMTP command injection flaw in data-source testing, allowing authenticated users to inject CR/LF sequences into SMTP envelope commands.

Calendar-related vulnerabilities, CVE-2026-93629 (Medium, CVSSv3 5.3), CVE-2026-93628 (Medium, CVSSv3 5.3), and CVE-2026-93627 (Medium, CVSSv3 5.3), allow unauthenticated senders to forge calendar invitations, responses, or cancellations attributed to other users. These issues stem from insufficient sender verification during the processing of iCalendar components. Lastly, CVE-2026-115786 (Medium, CVSSv3 6.5) is a mailbox quota-accounting vulnerability that enables authenticated users to consume other users' quotas by repeatedly sharing and revoking documents.

All 17 vulnerabilities were disclosed simultaneously on October 23, 2026, indicating a coordinated disclosure event. Zimbra has released patches to address these issues. Administrators are strongly advised to update their Zimbra Collaboration Suite installations to the latest versions to mitigate these risks. The breadth of these vulnerabilities highlights the need for continuous security monitoring and prompt application of security updates for all Zimbra users.

The disclosure of these 17 vulnerabilities on a single day underscores a critical security event for Zimbra Collaboration Suite users. The range of issues, from high-severity privilege escalations to various injection and authorization flaws, necessitates immediate attention from administrators. Promptly applying the available patches is crucial to protect against potential exploitation and maintain the integrity of user data and system access.

Key findings from this batch include:

Synthesized by Vypr AI