Rapid7 Discloses 17 Zimbra Collaboration Suite Vulnerabilities Breaking Identity Boundaries

TL;DR

Rapid7 researchers disclosed 17 security flaws in Zimbra Collaboration Suite (ZCS) that break authentication, mailbox isolation, and host privilege boundaries. These vulnerabilities allow attackers to hijack user sessions via cross-site scripting, read arbitrary mailboxes, and escalate local privileges to root. Administrators must apply the latest Zimbra patch releases immediately and audit server configurations.

Notable CVEs

Why It Matters

Zimbra Collaboration Suite is an enterprise email and collaboration platform used by thousands of government agencies and businesses worldwide. While exact counts of exposed servers are not specified in the vendor advisories, email servers remain primary targets for espionage and initial network access.

According to the Rapid7 technical research report, an attacker who compromises a single low-privileged account can chain these flaws to cross identity boundaries. As a result, they can access other mailboxes or root system files. Currently, no public proof-of-concept exploit code has been released, and no active exploitation in the wild has been confirmed.

How the Attack Works

The disclosed vulnerabilities span web client sanitization, calendar processing, LDAP lookups, and Linux sudo configurations.

Cross-Site Scripting and Session Hijacking

First, CVE-2026-10632 (CVSS 8.7) is a reflected cross-site scripting (XSS) flaw in the Classic Web Client’s /h/rest document editor, which inserts the packages parameter into script attributes without HTML encoding. When chained with the request attribute override flaw CVE-2026-50053 (CVSS 8.7), an authenticated attacker can pass their own token and document identifiers in a crafted URL. This allows them to run JavaScript inside another signed-in user’s session. Similarly, CVE-2026-93639 (CVSS 8.7) lets a delegated administrator trigger cross-account XSS.

In addition, CVE-2026-93638 (CVSS 6.1) allows unauthenticated attackers to execute JavaScript on the login page via the zrememberme parameter during a two-factor relogin error display. Meanwhile, CVE-2026-93633 (CVSS 5.4) bypasses DefangFilter CSS sanitization when Briefcase documents contain non-ASCII characters. Also, CVE-2026-93630 (CVSS 4.3) uses percent-encoded hostnames to bypass HTML form-action restrictions.

Local Root Privilege Escalation

Three high-severity flaws (CVSS 7.8) allow the local Unix zimbra account to gain root privileges via passwordless sudo rules. In CVE-2026-93640, the zmunbound wrapper in the optional dnscache package forwards arbitrary arguments to Unbound. This lets attackers disable chroot, expose root-readable files through parser errors, or overwrite privileged files. In CVE-2026-50057, attackers can point Postfix’s daemon_directory to a controlled path and run postfix set-permissions to execute a root post-install program. Furthermore, CVE-2026-50056 abuses unrestricted JVM arguments in the zmmailboxdmgr launcher during a mailboxd restart to run commands as root.

OAuth, Calendar, and Mailbox Manipulation

Several other bugs weaken account and protocol boundaries. CVE-2026-93631 (CVSS 7.1) is a cross-site request forgery (CSRF) flaw in the Network Edition OAuth callback that links an attacker’s external account to a victim’s mailbox. This exposes appointments via bidirectional CalDAV sync. In CVE-2026-115786 (CVSS 6.5), repeatedly sharing and revoking a document exhausts a recipient’s mailbox quota. This happens because revocation fails to reverse mailbox-wide size charges.

Furthermore, three iCalendar processing flaws allow unauthenticated email senders to cancel or modify meetings (CVE-2026-93627), forge attendee replies via null sender identities (CVE-2026-93628), or plant spoofed invitations (CVE-2026-93629). Finally, CVE-2026-93634 (CVSS 4.3) inserts forged shared-file records via FileSharedWithMeRequest. In addition, CVE-2026-93636 (CVSS 4.3) injects LDAP filter conditions into SearchCalendarResourcesRequest. Also, CVE-2026-115785 (CVSS 4.3) injects CRLF sequences into data-source test addresses to send spoofed SMTP messages.

Affected Versions

These Zimbra Collaboration Suite vulnerabilities affect various ZCS 10.1 releases up to and including version 10.1.21. Specifically, CVE-2026-10632 affects 10.1.16, while CVE-2026-93638 and CVE-2026-50053 affect versions through 10.1.17. Flaws such as CVE-2026-93631, CVE-2026-93633, CVE-2026-93634, CVE-2026-93639, CVE-2026-115785, and CVE-2026-115786 impact versions through 10.1.20. In addition, the local privilege escalation, calendar, and LDAP bugs affect versions through 10.1.21.

Patch and Mitigation Steps

Zimbra has rolled out fixes across versions 10.1.17, 10.1.18, 10.1.20, and subsequent security updates documented on the official Zimbra Security Advisories page. Administrators must upgrade their ZCS deployments to the latest available patch release immediately. In addition, security teams should audit sudoers policies on MTA and mailbox nodes, review linked OAuth data sources, and monitor for unauthorized mailbox delegations.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.