Zimbra Issues Emergency Patch for Critical SSRF Vulnerability in Chat Proxy Configuration

Zimbra has issued an emergency security patch (version 10.1.12) to fix a critical Server-Side Request Forgery (SSRF) in the chat proxy configuration. The patch, released on 16 October 2025, also includes stability and synchronization improvements and is recommended for administrators running Zimbra versions 10.1.5 to 10.1.11 to update immediately.

The advisory warns that unpatched, the flaw could allow attackers to manipulate internal server requests, potentially leading to data exposure, system compromise, or service disruption. Earlier this year, threat actors reportedly exploited an unpatched zero-day in Zimbra Collaboration Suite to deploy malicious JavaScript via ICS calendar files (CVE-2025-27915), though the new patch addresses the SSRF vulnerability in the chat proxy.

Administrators upgrading from 10.1.3 or earlier should ensure the latest zimbra-lds-patch package is installed and reactivate their license with zmlicense -a <license_key> after upgrading. In multi-server environments, only the proxy node servers will display the 10.1.12 version tag, while other nodes may continue showing 10.1.11.