Rapid7 Discloses 17 Flaws in Zimbra Collaboration Suite

Rapid7 researchers disclosed 17 vulnerabilities in Zimbra Collaboration Suite (ZCS) that traverse authentication, mailbox isolation and host-privilege boundaries. The flaws enable attackers to hijack user sessions through cross-site scripting and to read arbitrary mailboxes, with several bugs capable of escalating local privileges to root if chains are combined.

Zimbra has issued fixes across multiple 10.1 releases and administrators are urged to apply the latest security updates immediately and audit server configurations. The Rapid7 write-up notes that, at present, no public PoC exploit has been released and no active exploitation in the wild has been confirmed.

The vulnerabilities affect ZCS versions up to and including 10.1.21, with specific mapping: CVE-2026-10632 impacts 10.1.16; CVE-2026-93638 and CVE-2026-50053 affect through 10.1.17; CVE-2026-93631, CVE-2026-93633, CVE-2026-93634, CVE-2026-93639, CVE-2026-115785 and CVE-2026-115786 affect through 10.1.20; and the local privilege escalation, calendar and LDAP issues extend through 10.1.21.

Notable CVEs include CVE-2026-10632 (8.7, CWE-79), CVE-2026-50057 (7.8, CWE-732), CVE-2026-50056 (7.8, CWE-88) and CVE-2026-93631 (7.1, CWE-352). Zimbra’s patches are described as available in the official Zimbra Security Advisories, covering 10.1.17, 10.1.18, 10.1.20 and later updates. Administrators should audit sudoers on MTA and mailbox nodes, review OAuth data sources and monitor for unauthorized mailbox delegations, according to the reporting outlet.