{"schema_version":1,"title":"Zimbra vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 21 vulnerabilities in Zimbra: 4 in the last 7 days and 5 in the last 90 days, 6 of them critical and 1 exploited in the wild. The most recent, CVE-2026-93647, was published on 25 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/zimbra","json_url":"https://junglewise.ai/threats/vendors/zimbra.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/zimbra","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":6,"all_time":21,"critical":6,"exploited":1,"last_7_days":4,"last_30_days":4,"last_90_days":5,"last_365_days":5},"latest":[{"cve":"CVE-2026-93647","cvss":9.3,"slug":"cve-2026-93647-an-unauthenticated-calendar-sender-can-place-active-markup-in-a","title":"Zimbra Collaboration stored XSS in calendar COUNTER message From address","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.673+00:00","url":"https://junglewise.ai/threats/cve-2026-93647-an-unauthenticated-calendar-sender-can-place-active-markup-in-a"},{"cve":"CVE-2026-93643","cvss":9.8,"slug":"cve-2026-93643-when-onlyoffice-document-editing-is-available-an-unauthenticated","title":"Zimbra OnlyOffice path traversal and code execution","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.55+00:00","url":"https://junglewise.ai/threats/cve-2026-93643-when-onlyoffice-document-editing-is-available-an-unauthenticated"},{"cve":"CVE-2026-93642","cvss":9.3,"slug":"cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that","title":"Zimbra Collaboration stored XSS in share notifications","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.423+00:00","url":"https://junglewise.ai/threats/cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that"},{"cve":"CVE-2026-93641","cvss":9.3,"slug":"cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that","title":"Zimbra Collaboration stored XSS in share notifications","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.29+00:00","url":"https://junglewise.ai/threats/cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that"},{"cve":"CVE-2026-73570","cvss":9.8,"epss":0.1174,"slug":"cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp","title":"Zimbra Collaboration Suite OS command injection in SMTP","severity":"critical","exploited":true,"published_at":"2026-08-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp"},{"cve":"CVE-2016-4019","cvss":7.5,"slug":"cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown","title":"Zimbra Collaboration Suite integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.75+00:00","url":"https://junglewise.ai/threats/cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown"},{"cve":"CVE-2016-3999","cvss":6.1,"slug":"cve-2016-3999-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration multiple XSS vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.703+00:00","url":"https://junglewise.ai/threats/cve-2016-3999-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3415","cvss":9.1,"slug":"cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified","title":"Zimbra Collaboration deserialization attack via unspecified vectors","severity":"critical","exploited":false,"published_at":"2017-01-18T22:59:00.67+00:00","url":"https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified"},{"cve":"CVE-2016-3414","cvss":6.5,"slug":"cve-2016-3414-zimbra-collaboration-denial-of-service-in-mailboxd","title":"Zimbra Collaboration denial of service in mailboxd","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.623+00:00","url":"https://junglewise.ai/threats/cve-2016-3414-zimbra-collaboration-denial-of-service-in-mailboxd"},{"cve":"CVE-2016-3413","cvss":7.5,"slug":"cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.593+00:00","url":"https://junglewise.ai/threats/cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"},{"cve":"CVE-2016-3412","cvss":6.1,"slug":"cve-2016-3412-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration Multiple XSS Vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.563+00:00","url":"https://junglewise.ai/threats/cve-2016-3412-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3411","cvss":6.1,"slug":"cve-2016-3411-zimbra-collaboration-xss-in-changepass-component","title":"Zimbra Collaboration XSS in changepass component","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.53+00:00","url":"https://junglewise.ai/threats/cve-2016-3411-zimbra-collaboration-xss-in-changepass-component"},{"cve":"CVE-2016-3410","cvss":6.1,"slug":"cve-2016-3410-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration multiple XSS vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.5+00:00","url":"https://junglewise.ai/threats/cve-2016-3410-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3409","cvss":6.1,"slug":"cve-2016-3409-zimbra-collaboration-xss-in-unspecified-components","title":"Zimbra Collaboration XSS in unspecified components","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.467+00:00","url":"https://junglewise.ai/threats/cve-2016-3409-zimbra-collaboration-xss-in-unspecified-components"},{"cve":"CVE-2016-3408","cvss":6.1,"slug":"cve-2016-3408-zimbra-collaboration-xss-in-unspecified-component","title":"Zimbra Collaboration XSS in unspecified component","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.42+00:00","url":"https://junglewise.ai/threats/cve-2016-3408-zimbra-collaboration-xss-in-unspecified-component"},{"cve":"CVE-2016-3407","cvss":6.1,"slug":"cve-2016-3407-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration multiple XSS vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.39+00:00","url":"https://junglewise.ai/threats/cve-2016-3407-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3406","cvss":8.8,"slug":"cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers","title":"Zimbra Collaboration CSRF in Client uploader and REST handlers","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.343+00:00","url":"https://junglewise.ai/threats/cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers"},{"cve":"CVE-2016-3405","cvss":7.5,"slug":"cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities","title":"Zimbra Collaboration multiple unspecified vulnerabilities","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.313+00:00","url":"https://junglewise.ai/threats/cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities"},{"cve":"CVE-2016-3404","cvss":7.5,"slug":"cve-2016-3404-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.28+00:00","url":"https://junglewise.ai/threats/cve-2016-3404-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"},{"cve":"CVE-2016-3402","cvss":7.5,"slug":"cve-2016-3402-zimbra-collaboration-unspecified-confidentiality-vulnerability","title":"Zimbra Collaboration unspecified confidentiality vulnerability","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.25+00:00","url":"https://junglewise.ai/threats/cve-2016-3402-zimbra-collaboration-unspecified-confidentiality-vulnerability"},{"cve":"CVE-2016-3401","cvss":6.5,"slug":"cve-2016-3401-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.203+00:00","url":"https://junglewise.ai/threats/cve-2016-3401-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"}],"vendor":{"hub":true,"name":"Zimbra","slug":"zimbra","homepage":"https://www.zimbra.com/","description":"A software company that develops collaboration and email server solutions.","url":"https://junglewise.ai/threats/vendors/zimbra"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":1,"exploited":1,"vulnerabilities":1},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":4,"exploited":0,"vulnerabilities":4}],"most_severe":[{"cve":"CVE-2026-73570","cvss":9.8,"epss":0.1174,"slug":"cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp","title":"Zimbra Collaboration Suite OS command injection in SMTP","severity":"critical","exploited":true,"published_at":"2026-08-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp"},{"cve":"CVE-2026-93643","cvss":9.8,"slug":"cve-2026-93643-when-onlyoffice-document-editing-is-available-an-unauthenticated","title":"Zimbra OnlyOffice path traversal and code execution","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.55+00:00","url":"https://junglewise.ai/threats/cve-2026-93643-when-onlyoffice-document-editing-is-available-an-unauthenticated"},{"cve":"CVE-2026-93647","cvss":9.3,"slug":"cve-2026-93647-an-unauthenticated-calendar-sender-can-place-active-markup-in-a","title":"Zimbra Collaboration stored XSS in calendar COUNTER message From address","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.673+00:00","url":"https://junglewise.ai/threats/cve-2026-93647-an-unauthenticated-calendar-sender-can-place-active-markup-in-a"},{"cve":"CVE-2026-93642","cvss":9.3,"slug":"cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that","title":"Zimbra Collaboration stored XSS in share notifications","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.423+00:00","url":"https://junglewise.ai/threats/cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that"},{"cve":"CVE-2026-93641","cvss":9.3,"slug":"cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that","title":"Zimbra Collaboration stored XSS in share notifications","severity":"critical","exploited":false,"published_at":"2026-09-25T14:17:23.29+00:00","url":"https://junglewise.ai/threats/cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that"},{"cve":"CVE-2016-3415","cvss":9.1,"slug":"cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified","title":"Zimbra Collaboration deserialization attack via unspecified vectors","severity":"critical","exploited":false,"published_at":"2017-01-18T22:59:00.67+00:00","url":"https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified"},{"cve":"CVE-2016-3406","cvss":8.8,"slug":"cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers","title":"Zimbra Collaboration CSRF in Client uploader and REST handlers","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.343+00:00","url":"https://junglewise.ai/threats/cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers"},{"cve":"CVE-2016-4019","cvss":7.5,"slug":"cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown","title":"Zimbra Collaboration Suite integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.75+00:00","url":"https://junglewise.ai/threats/cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown"},{"cve":"CVE-2016-3413","cvss":7.5,"slug":"cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.593+00:00","url":"https://junglewise.ai/threats/cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"},{"cve":"CVE-2016-3405","cvss":7.5,"slug":"cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities","title":"Zimbra Collaboration multiple unspecified vulnerabilities","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.313+00:00","url":"https://junglewise.ai/threats/cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities"}],"generated_at":"2026-09-26T11:07:00.153785+00:00","technologies":[{"name":"Zimbra-Collaboration-Suite","slug":"collaboration","vulnerabilities":17,"url":"https://junglewise.ai/threats/technologies/collaboration"}]}