Rapid7 Discovers Over 80 Vulnerabilities in Zimbra Collaboration Suite

Rapid7 researchers disclosed more than 80 vulnerabilities in Zimbra Collaboration Suite (ZCS) during a comprehensive security assessment. The findings span authentication, mailbox authorization, calendar processing, web clients, document services, and the host operating system. The company is publishing its analysis in stages because affected components are being fixed on different schedules.

This first report focuses on five account-related vulnerabilities. Rapid7 assigned CVSS scores ranging from 3.7 to 8.3 for these specific issues. Some flaws have public fixes in recent ZCS releases, while others currently have no confirmed patch. An accompanying GitHub repository serves as a live technical tracker for full write-ups and proof-of-concept code.

Technical Details of Account Flaws

The first article concentrates on five specific CVEs affecting user accounts. CVE-2026-73571, rated high with a CVSS of 8.3, allows email impersonation via SaveDraftRequest and is fixed in ZCS 10.1.17. Two medium-severity issues, CVE-2026-10631 and CVE-2026-50055, allow cross-user mailbox access and Sieve forwarding bypass, respectively, and are fixed in ZCS 10.1.20.

Two other issues remain unpatched. CVE-2026-93637 is a GraphQL authentication rate-limit bypass rated low (3.7). CVE-2026-93635 is an LDAP filter injection rated medium (5.3). These pre-authentication findings lower barriers to obtaining a foothold by hiding failed password attempts or bypassing account-lockout policies.

Impact on Enterprise Mail Infrastructure

Zimbra Collaboration Suite is a self-hosted platform for email, calendars, contacts, tasks, and file sharing. Compromising the server can expose private communications and the identities built around it. The assessment initially targeted ZCS 10.1.16_GA_4850 Network Edition on Ubuntu 22.04.

An attacker with an ordinary compromised account can exploit these flaws independently. For example, CVE-2026-73571 allows placing messages in any local user's mailbox. If Exchange Web Services (EWS) is enabled, attackers can read private conversations and calendar entries from other users' mailboxes using CVE-2026-10631.

What should you do?

Administrators should review their ZCS version against the fixed releases listed. ZCS 10.1.17 addresses the high-severity email impersonation flaw. ZCS 10.1.20 fixes the EWS cross-user access and Sieve forwarding bypass issues. Organizations running older versions should monitor the Rapid7 GitHub repository for updates on the unpatched GraphQL and LDAP flaws.

What to do and how to stay safe: Zimbra

• Verify your Zimbra Collaboration Suite version and apply updates to 10.1.17 or 10.1.20 if available.
• Monitor the Rapid7 GitHub repository for new patches regarding CVE-2026-93637 and CVE-2026-93635.
• Review server logs for unusual authentication attempts or unexpected email forwarding rules.
• Restrict access to Zimbra web clients and EWS endpoints to trusted networks where possible.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Zimbra versions are affected by these vulnerabilities?

The assessment initially targeted ZCS 10.1.16_GA_4850, but fixes are provided in 10.1.17 and 10.1.20 for specific CVEs.

Are all 80 vulnerabilities fixed yet?

No, the components are being fixed on different schedules, and some account-related flaws currently have no public fix.

What is the severity of the email impersonation flaw?

CVE-2026-73571 is rated high with a CVSS score of 8.3 and is fixed in ZCS 10.1.17.