Zimbra released version 10.1.20 of its Collaboration Suite to fix several critical security defects. The most severe is a command injection vulnerability in the SNMP monitoring component that allows unauthenticated attackers to execute arbitrary OS commands if SNMP notifications and the integrated Swatchdog service are enabled. Additionally, four XSS vulnerabilities in the Classic Web Client could lead to script execution via malicious attachment filenames or crafted fields. The update also patches CVE-2026-50055, a mail forwarding restriction bypass enabling exfiltration of emails despite restrictions, an access control flaw in the EWS extension (CVE-2026-10631), an authorization issue in mailbox delegation (CVE-2026-50054), and an SSRF vulnerability in the Nextcloud integration. Zimbra has not disclosed further technical details or evidence of active exploitation but strongly recommends upgrading to 10.1.20.

Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary operating system commands on the email server, run malicious scripts in users' browsers, bypass mail forwarding restrictions to exfiltrate emails, and perform unauthorized access or actions within mailbox delegation and EWS extensions. This could lead to full compromise of the email server, unauthorized data disclosure, and potential further network compromise. The vulnerabilities affect core components of the Zimbra Collaboration Suite, impacting confidentiality, integrity, and availability of email services.

Zimbra has released version 10.1.20 which includes permanent fixes for all the described vulnerabilities. Users should update to ZCS 10.1.20 as soon as possible to mitigate these critical security risks. There is no indication that these vulnerabilities have been exploited in the wild. No additional vendor-recommended mitigations or workarounds are provided beyond applying the official update.