Skip to content
Multiple Vulnerabilities Discovered in Zimbra Collaboration Suite

Multiple Vulnerabilities Discovered in Zimbra Collaboration Suite

First seen 14 Oct 2026, 20:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 21:33 UTC

Rapid7 reported over 80 vulnerabilities in the Zimbra Collaboration Suite (ZCS), affecting authentication and mailbox access. Key vulnerabilities include CVE-2026-50055, a medium severity flaw allowing email impersonation, and CVE-2026-73571, which enables unauthorized mailbox access. The vulnerabilities span various components, including GraphQL authentication and LDAP filter injection. A GitHub repository has been created to track these vulnerabilities, including detailed write-ups and proofs of concept. The vulnerabilities are being fixed on different schedules, with the first article focusing on five account-related issues. Future articles will cover additional vulnerabilities, including unauthenticated stored XSS paths. Organizations using ZCS should prioritize reviewing their configurations and applying any available patches.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-07-22
Public exploit for CVE-2026-50055 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-08-13
CVE-2026-73571 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-08
Multiple CVEs published
CVE-2026-50055, CVE-2026-10631, and CVE-2026-50054 were published, addressing various vulnerabilities in ZCS.
Rapid7
2026-10-08
CVE-2026-10631 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-08
CVE-2026-50054 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-14
Rapid7 publishes vulnerability report
Rapid7 disclosed over 80 vulnerabilities in Zimbra Collaboration Suite, detailing several key flaws.
Rapid7
2026-10-14
GitHub repository launched
A GitHub repository was created to document ZCS vulnerabilities, including technical write-ups and PoCs.
github.com
2026-10-14
CVE-2026-93637 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-14
CVE-2026-93635 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (5)

Following this threat?

Track Ubuntu and CVE-2026-10631 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

Which versions of ZCS are affected?
The vulnerabilities affect various versions of the Zimbra Collaboration Suite, with specific details available in the GitHub repository.
Are these vulnerabilities actively exploited?
There is no confirmation of active exploitation, but proof-of-concept code is available for some vulnerabilities.
What should organizations using ZCS do?
Organizations should review their configurations, monitor for updates, and apply patches as they become available.