CVE Tools
Track your stack

Zimbra Collaboration Suite

130 CVEs tracked. 19 of them are in CISA KEV.

This hub aggregates every CVE we track for Zimbra Collaboration Suite, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.

Zimbra Collaboration Suite CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Zimbra Collaboration Suite CVEs per month
MonthCVEs
2024-119
2024-121
2025-010
2025-022
2025-032
2025-041
2025-051
2025-061
2025-072
2025-080
2025-090
2025-101
2025-110
2025-121
2026-011
2026-020
2026-036
2026-040
2026-050
2026-060
2026-070
2026-087
2026-090
2026-1022

Severity

How the 130 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical129%
  • High3628%
  • Medium7759%
  • Low54%

Latest CVEs

The 15 most recently published vulnerabilities affecting Zimbra Collaboration Suite.

  1. CVE-2026-115786Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion6.5
  2. CVE-2026-115785Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address4.3
  3. CVE-2026-93640Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration7.8
  4. CVE-2026-50057Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions7.8
  5. CVE-2026-50056Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection7.8
  6. CVE-2026-93639Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation8.7
  7. CVE-2026-93638Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter6.1
  8. CVE-2026-93636Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name4.3
  9. CVE-2026-93634Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records4.3
  10. CVE-2026-93633Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters5.4
  11. CVE-2026-93631Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking7.1
  12. CVE-2026-93630Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization4.3
  13. CVE-2026-93629Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity5.3
  14. CVE-2026-93628Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response5.3
  15. CVE-2026-93627Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer5.3

Product grouping is registry-driven, with AI assist and human review. How it works