Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol (SNMP) monitoring component.
As many as nine security vulnerabilities have been patched in Zimbra 10.1.20. Topping the list is a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled.
Also patched are four cross-site scripting (XSS) flaws in the Classic Web Client –
- A stored cross-site scripting (XSS) vulnerability that could allow malicious attachment filenames to execute script under specific conditions.
- An XSS vulnerability where crafted fields could execute a malicious script under specific conditions.
- An XSS vulnerability where a crafted field could execute a malicious script when rendered.
- An XSS vulnerability where crafted attachments could execute a malicious script when rendered.
Separately, fixes have been released for a mail forwarding restriction bypass (CVE-2026-50055) that could allow authenticated users to exfiltrate email despite mail forwarding restrictions being enabled. Rapid7 security researcher Jonah Burgess has been credited with discovering and reporting the flaw.
The company did not share any additional specifics, stating “in line with industry best practices, information disclosure is limited for security vulnerability fixes.”
The release comes a little over a week after Zimbra patched a critical stored XSS flaw in the Classic Web Client that could result in arbitrary code execution.
Although none of the identified vulnerabilities have been flagged as actively exploited, XSS bugs in the email software have been repeatedly exploited by bad actors in the past, making it crucial that customers apply the updates to keep the environment secure.
