Loading story…
Zimbra Collaboration versions earlier than 10.1.20 were flagged in security advisories warning of vulnerabilities that require vendor-issued updates. The advisory, identified as AV26-816, prompted national cyber authorities to direct administrators to review Zimbra’s remediation guidance and upgrade affected deployments.
The Canadian Centre for Cyber Security and Guyana National CIRT both urged organizations to assess their exposure, prioritize patching, and apply the available update where necessary. The notices emphasize that systems running unsupported or unpatched Zimbra releases remain at risk until they are brought to 10.1.20 or later in line with the vendor advisory.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On August 14, 2026, the Guyana National CIRT published a notice on the Zimbra advisory and recommended that organizations assess exposure and apply the update where necessary. The notice pointed readers to the vendor advisory for remediation details.
On August 14, 2026, the Canadian Centre for Cyber Security published advisory AV26-816 about the Zimbra vulnerabilities. The notice urged users and administrators to review Zimbra advisories and apply necessary updates as they become available.
On August 13, 2026, Zimbra published a security advisory stating that Zimbra Collaboration versions prior to 10.1.20 are affected by vulnerabilities. The advisory recommended keeping the product updated and applying the relevant update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zimbra released **Zimbra Collaboration Suite 10.1.20** to patch multiple critical and high-severity vulnerabilities affecting its email and collaboration platform, including versions of the **Classic Web Client** prior to `10.1.20`. The most serious issue is a critical unauthenticated command injection flaw in the SNMP monitoring component that could allow arbitrary operating system command execution when SNMP notifications are enabled and the integrated Swatchdog service is running. Zimbra and the Canadian Centre for Cyber Security urged administrators and users to review the advisory and apply the update promptly. The release also fixes four cross-site scripting vulnerabilities in the Classic Web Client, a mail forwarding restriction bypass tracked as **CVE-2026-50055**, an access control flaw in the EWS extension tracked as **CVE-2026-10631**, an authorization issue in mailbox delegation tracked as **CVE-2026-50054**, and a server-side request forgery bug in the Nextcloud integration. Zimbra said customers should update as soon as possible and did not report evidence that the vulnerabilities had been exploited in the wild.
Jul 24, 2026
A high-severity remote code execution flaw, tracked as **`CVE-2026-73570`**, was disclosed and patched in **Zimbra Collaboration** versions earlier than **10.1.20**. The vulnerability affects deployments where the optional **`zimbra-snmp`** package is installed and **SNMP notifications** are enabled, and stems from improper sanitization of untrusted input during SNMP notification processing, classified as **`CWE-78`**. An unauthenticated attacker could exploit the issue by sending specially crafted **SMTP** requests, potentially executing arbitrary operating system commands as the **Zimbra** user. The flaw carries a **CVSS v3.1** vector of **`AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L`**, while CISA SSVC metadata indicates **no known exploitation** and **non-automatable** attack conditions. Italian authorities and vendor guidance urged administrators to update affected systems to **version 10.1.20** or later following the published security bulletin.
Aug 14, 2026
Zimbra released an emergency patch to address a critical Server-Side Request Forgery (SSRF) vulnerability affecting the chat proxy configuration in its Daffodil product. The vulnerability was identified in versions of Zimbra Daffodil prior to v10.1.12, prompting immediate action from the vendor. Security advisories highlighted the potential for attackers to exploit this flaw, which could allow unauthorized access to internal resources or sensitive information by manipulating the chat proxy configuration. The Canadian Centre for Cyber Security issued an alert (AV25-678) urging users and administrators to review the official Zimbra advisory and apply the necessary updates without delay. The emergency patch, included in Zimbra Daffodil version 10.1.12, was made available to mitigate the risk associated with this vulnerability. The flaw's critical nature raised concerns about the potential for remote exploitation, especially in environments where Zimbra's chat functionality is exposed to untrusted networks. Organizations relying on Zimbra for email and collaboration services were advised to prioritize patch deployment to prevent possible compromise. The vulnerability's disclosure and rapid patch release underscore the importance of timely vulnerability management in enterprise environments. Security experts noted that SSRF vulnerabilities can be leveraged to bypass network restrictions, access internal services, or facilitate further attacks. The Zimbra advisory provided technical details and guidance for administrators to verify successful patch application. No reports of active exploitation were mentioned at the time of the advisory, but the urgency of the patch suggests a high risk of exploitation if left unaddressed. The incident highlights the ongoing challenges faced by software vendors in securing complex collaboration platforms. Zimbra's response included not only the patch but also recommendations for monitoring and additional security best practices. The Cyber Centre's involvement reflects the vulnerability's significance for Canadian organizations and the broader global user base. Administrators were reminded to review their systems for signs of compromise and to ensure all relevant updates are applied promptly. The event serves as a reminder of the critical role of coordinated disclosure and rapid response in minimizing the impact of software vulnerabilities.
Jul 12, 2026