# Zimbra Collaboration Suite.

Every CVE that names Zimbra Collaboration Suite among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion](https://agentprime.io/advisories/CVE-2026-115786.md)
  `CVE-2026-115786` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-682
- [Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address](https://agentprime.io/advisories/CVE-2026-115785.md)
  `CVE-2026-115785` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Other injection
- [Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration](https://agentprime.io/advisories/CVE-2026-93640.md)
  `CVE-2026-93640` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions](https://agentprime.io/advisories/CVE-2026-50057.md)
  `CVE-2026-50057` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection](https://agentprime.io/advisories/CVE-2026-50056.md)
  `CVE-2026-50056` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: Command injection
- [Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation](https://agentprime.io/advisories/CVE-2026-93639.md)
  `CVE-2026-93639` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter](https://agentprime.io/advisories/CVE-2026-93638.md)
  `CVE-2026-93638` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 6.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name](https://agentprime.io/advisories/CVE-2026-93636.md)
  `CVE-2026-93636` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Other injection
- [Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records](https://agentprime.io/advisories/CVE-2026-93634.md)
  `CVE-2026-93634` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters](https://agentprime.io/advisories/CVE-2026-93633.md)
  `CVE-2026-93633` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 5.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking](https://agentprime.io/advisories/CVE-2026-93631.md)
  `CVE-2026-93631` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization](https://agentprime.io/advisories/CVE-2026-93630.md)
  `CVE-2026-93630` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-180
- [Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity](https://agentprime.io/advisories/CVE-2026-93629.md)
  `CVE-2026-93629` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response](https://agentprime.io/advisories/CVE-2026-93628.md)
  `CVE-2026-93628` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer](https://agentprime.io/advisories/CVE-2026-93627.md)
  `CVE-2026-93627` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters](https://agentprime.io/advisories/CVE-2026-50053.md)
  `CVE-2026-50053` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-642
- [Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter](https://agentprime.io/advisories/CVE-2026-10632.md)
  `CVE-2026-10632` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting](https://agentprime.io/advisories/CVE-2026-93637.md)
  `CVE-2026-93637` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 3.7 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution](https://agentprime.io/advisories/CVE-2026-93635.md)
  `CVE-2026-93635` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Other injection
- [Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion](https://agentprime.io/advisories/CVE-2026-50055.md)
  `CVE-2026-50055` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right](https://agentprime.io/advisories/CVE-2026-50054.md)
  `CVE-2026-50054` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation
- [Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier](https://agentprime.io/advisories/CVE-2026-10631.md)
  `CVE-2026-10631` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=zimbra-collaboration-suite>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/zimbra-collaboration-suite/>. Everything for agents: <https://agentprime.io/llms.txt>.