Key points
- Three of the five reported flaws have patches in ZCS 10.1.17 and 10.1.20.
- Two vulnerabilities, including an LDAP injection, currently lack public fixes.
- Attackers can impersonate users and read private mailboxes using these flaws.
Zimbra Collaboration Suite versions prior to 10.1.17 and 10.1.20 are affected by five account-related vulnerabilities identified by Rapid7. Patches exist for three of these issues, but two remain unfixed. Administrators must determine which version they run and apply updates where available.
In plain English
These flaws allow attackers to bypass identity controls. One issue lets attackers send emails that appear to come from any local user, effectively impersonating colleagues. Another allows reading private messages, drafts, and contacts from other users' mailboxes if Exchange Web Services is enabled. A third flaw lets attackers set up email forwarding that persists even if the victim changes their password.
The background
Rapid7 reported more than 80 vulnerabilities in Zimbra during a broader assessment. This first report focuses on five account-related issues. The remaining findings, including cross-site scripting and remote code execution, will be published in subsequent articles. The company maintains a GitHub repository with proof-of-concept code and technical details.
Who needs to act first
Teams should prioritize systems that are directly accessible from the internet or corporate networks. Check whether your deployment uses Exchange Web Services or external LDAP authentication, as these features expand the attack surface. If a patch is unavailable, consider isolating the server from untrusted networks. Back up configuration files before applying any updates. Monitor logs for unusual authentication attempts or unexpected email forwarding rules.
What to do and how to stay safe: Zimbra
- Apply the latest Zimbra Collaboration Suite updates immediately, specifically versions 10.1.17 and 10.1.20 if you are on older releases.
- Disable Exchange Web Services if it is not required for your Outlook integration, reducing the risk of mailbox access.
- Monitor server logs for signs of unauthorized forwarding rules or impersonation attempts, especially from compromised accounts.
- Review LDAP configurations to ensure account lockout policies are correctly applied to prevent brute-force attacks.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Zimbra versions are affected by these five vulnerabilities?
Versions prior to 10.1.17 and 10.1.20 are affected, with specific fixes released in those versions for three of the flaws.
Is there a fix for the LDAP filter injection vulnerability?
No, Rapid7 states that there is no public fix listed for CVE-2026-93635, the LDAP filter injection flaw.
Can attackers access other users' mailboxes with these flaws?
Yes, if Exchange Web Services is enabled, attackers can read private conversations and contacts from other users' mailboxes.
