{"schema_version":1,"title":"Zimbra-Collaboration-Suite vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 19 vulnerabilities in Zimbra-Collaboration-Suite: 2 in the last 7 days and 3 in the last 90 days, 4 of them critical and 1 exploited in the wild. The most recent, CVE-2026-93642, was published on 25 September 2026.","url":"https://junglewise.ai/threats/technologies/collaboration","json_url":"https://junglewise.ai/threats/technologies/collaboration.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/collaboration","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":6,"all_time":19,"critical":4,"exploited":1,"last_7_days":2,"last_30_days":2,"last_90_days":3,"last_365_days":3},"latest":[{"cve":"CVE-2026-93642","cvss":9.3,"slug":"cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that","title":"Zimbra Collaboration stored XSS in share notifications","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.423+00:00","url":"https://junglewise.ai/threats/cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that"},{"cve":"CVE-2026-93641","cvss":9.3,"slug":"cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that","title":"Zimbra Collaboration stored XSS in share notifications","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.29+00:00","url":"https://junglewise.ai/threats/cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that"},{"cve":"CVE-2026-73570","cvss":9.8,"epss":0.1174,"slug":"cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp","title":"Zimbra Collaboration Suite OS command injection in SMTP","severity":"critical","exploited":true,"published_at":"2026-08-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp"},{"cve":"CVE-2016-4019","cvss":7.5,"slug":"cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown","title":"Zimbra Collaboration Suite integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.75+00:00","url":"https://junglewise.ai/threats/cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown"},{"cve":"CVE-2016-3999","cvss":6.1,"slug":"cve-2016-3999-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration multiple XSS vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.703+00:00","url":"https://junglewise.ai/threats/cve-2016-3999-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3415","cvss":9.1,"slug":"cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified","title":"Zimbra Collaboration deserialization attack via unspecified vectors","severity":"critical","exploited":false,"published_at":"2017-01-18T22:59:00.67+00:00","url":"https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified"},{"cve":"CVE-2016-3414","cvss":6.5,"slug":"cve-2016-3414-zimbra-collaboration-denial-of-service-in-mailboxd","title":"Zimbra Collaboration denial of service in mailboxd","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.623+00:00","url":"https://junglewise.ai/threats/cve-2016-3414-zimbra-collaboration-denial-of-service-in-mailboxd"},{"cve":"CVE-2016-3413","cvss":7.5,"slug":"cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.593+00:00","url":"https://junglewise.ai/threats/cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"},{"cve":"CVE-2016-3412","cvss":6.1,"slug":"cve-2016-3412-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration Multiple XSS Vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.563+00:00","url":"https://junglewise.ai/threats/cve-2016-3412-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3411","cvss":6.1,"slug":"cve-2016-3411-zimbra-collaboration-xss-in-changepass-component","title":"Zimbra Collaboration XSS in changepass component","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.53+00:00","url":"https://junglewise.ai/threats/cve-2016-3411-zimbra-collaboration-xss-in-changepass-component"},{"cve":"CVE-2016-3410","cvss":6.1,"slug":"cve-2016-3410-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration multiple XSS vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.5+00:00","url":"https://junglewise.ai/threats/cve-2016-3410-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3409","cvss":6.1,"slug":"cve-2016-3409-zimbra-collaboration-xss-in-unspecified-components","title":"Zimbra Collaboration XSS in unspecified components","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.467+00:00","url":"https://junglewise.ai/threats/cve-2016-3409-zimbra-collaboration-xss-in-unspecified-components"},{"cve":"CVE-2016-3408","cvss":6.1,"slug":"cve-2016-3408-zimbra-collaboration-xss-in-unspecified-component","title":"Zimbra Collaboration XSS in unspecified component","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.42+00:00","url":"https://junglewise.ai/threats/cve-2016-3408-zimbra-collaboration-xss-in-unspecified-component"},{"cve":"CVE-2016-3407","cvss":6.1,"slug":"cve-2016-3407-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration multiple XSS vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.39+00:00","url":"https://junglewise.ai/threats/cve-2016-3407-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3406","cvss":8.8,"slug":"cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers","title":"Zimbra Collaboration CSRF in Client uploader and REST handlers","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.343+00:00","url":"https://junglewise.ai/threats/cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers"},{"cve":"CVE-2016-3405","cvss":7.5,"slug":"cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities","title":"Zimbra Collaboration multiple unspecified vulnerabilities","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.313+00:00","url":"https://junglewise.ai/threats/cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities"},{"cve":"CVE-2016-3404","cvss":7.5,"slug":"cve-2016-3404-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.28+00:00","url":"https://junglewise.ai/threats/cve-2016-3404-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"},{"cve":"CVE-2016-3402","cvss":7.5,"slug":"cve-2016-3402-zimbra-collaboration-unspecified-confidentiality-vulnerability","title":"Zimbra Collaboration unspecified confidentiality vulnerability","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.25+00:00","url":"https://junglewise.ai/threats/cve-2016-3402-zimbra-collaboration-unspecified-confidentiality-vulnerability"},{"cve":"CVE-2016-3401","cvss":6.5,"slug":"cve-2016-3401-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.203+00:00","url":"https://junglewise.ai/threats/cve-2016-3401-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":1,"exploited":1,"vulnerabilities":1},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":2,"exploited":0,"vulnerabilities":2}],"related":[],"technology":{"hub":true,"name":"Zimbra-Collaboration-Suite","slug":"collaboration","vendor":{"name":"Zimbra","slug":"zimbra","url":"https://junglewise.ai/threats/vendors/zimbra"},"aliases":["collaboration-suite"],"category":"application","homepage":"https://www.zimbra.com/","repo_url":"https://github.com/Zimbra/zm-build","description":"Zimbra Collaboration is an open-source messaging and collaboration platform that includes email, calendaring, and file sharing capabilities.","url":"https://junglewise.ai/threats/technologies/collaboration"},"most_severe":[{"cve":"CVE-2026-73570","cvss":9.8,"epss":0.1174,"slug":"cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp","title":"Zimbra Collaboration Suite OS command injection in SMTP","severity":"critical","exploited":true,"published_at":"2026-08-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp"},{"cve":"CVE-2026-93642","cvss":9.3,"slug":"cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that","title":"Zimbra Collaboration stored XSS in share notifications","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.423+00:00","url":"https://junglewise.ai/threats/cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that"},{"cve":"CVE-2026-93641","cvss":9.3,"slug":"cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that","title":"Zimbra Collaboration stored XSS in share notifications","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.29+00:00","url":"https://junglewise.ai/threats/cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that"},{"cve":"CVE-2016-3415","cvss":9.1,"slug":"cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified","title":"Zimbra Collaboration deserialization attack via unspecified vectors","severity":"critical","exploited":false,"published_at":"2017-01-18T22:59:00.67+00:00","url":"https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified"},{"cve":"CVE-2016-3406","cvss":8.8,"slug":"cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers","title":"Zimbra Collaboration CSRF in Client uploader and REST handlers","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.343+00:00","url":"https://junglewise.ai/threats/cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers"},{"cve":"CVE-2016-4019","cvss":7.5,"slug":"cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown","title":"Zimbra Collaboration Suite integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.75+00:00","url":"https://junglewise.ai/threats/cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown"},{"cve":"CVE-2016-3413","cvss":7.5,"slug":"cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.593+00:00","url":"https://junglewise.ai/threats/cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"},{"cve":"CVE-2016-3405","cvss":7.5,"slug":"cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities","title":"Zimbra Collaboration multiple unspecified vulnerabilities","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.313+00:00","url":"https://junglewise.ai/threats/cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities"},{"cve":"CVE-2016-3404","cvss":7.5,"slug":"cve-2016-3404-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.28+00:00","url":"https://junglewise.ai/threats/cve-2016-3404-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"},{"cve":"CVE-2016-3402","cvss":7.5,"slug":"cve-2016-3402-zimbra-collaboration-unspecified-confidentiality-vulnerability","title":"Zimbra Collaboration unspecified confidentiality vulnerability","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.25+00:00","url":"https://junglewise.ai/threats/cve-2016-3402-zimbra-collaboration-unspecified-confidentiality-vulnerability"}],"generated_at":"2026-09-26T11:07:00.153785+00:00"}