Zimbra Collaboration: multiple flaws incl. cross-site scripting (CVE-2026-10632, CVE-2026-50053), no fix known
CVE-2026-10631 CVE-2026-10632 CVE-2026-115785 CVE-2026-115786 CVE-2026-50053 CVE-2026-50054 CVE-2026-50055 CVE-2026-50056 CVE-2026-50057 CVE-2026-73570 CVE-2026-73571 CVE-2026-73572 CVE-2026-73573 CVE-2026-73574 CVE-2026-73575 CVE-2026-73576 CVE-2026-93627 CVE-2026-93628 CVE-2026-93629 CVE-2026-93630 CVE-2026-93631 CVE-2026-93633 CVE-2026-93634 CVE-2026-93636 CVE-2026-93638 CVE-2026-93639 CVE-2026-93640
Published 01/11/2026 02:09
Timeline
2 events over 5 d 12 h
- 26/10/2026 13:29ConfirmedBSI CERT-Bund (WID)+5 d 12 h
- 01/11/2026 02:09Published on WatchtowerPro CISO
In short
Zimbra Collaboration Suite has multiple vulnerabilities, including cross-site scripting (CVE-2026-10632) and a request attribute override (CVE-2026-50053). Germany's BSI CERT-Bund warns of a wider set of flaws, and a social media post says Rapid7 disclosed 17. No fixed version is known yet. GreyNoise reports a public exploit for CVE-2026-10631 (01/11/2026).
How bad is it
High. CERT-Bund warns an attacker could run code, gain root, bypass security or inject script in Zimbra; the exact requirements are not yet established.
Being exploited - on CISA's known-exploited list since 21/08/2026.
Severity score
The worst of 27 CVEs · CVSS 3.1 from NVD, from mitre.org, read 01/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Slow it down or interrupt it
Type: cross-site scripting.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Zimbra Classic Web Client (reflected cross-site scripting, CVE-2026-10632); affected versions not established.
- Zimbra request handling for /h/* paths (request attribute override, CVE-2026-50053); affected versions not established.
What to do now
- No fixed version is known yet; watch the Zimbra Security Center, NVD and national CERT notices for a vendor update and apply it as soon as it is released.
- Until then, restrict access to the Zimbra web client and /h/* paths to trusted networks or a VPN where practical. This reduces exposure but does not make the server safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 5 sources with their dates. And technology matching: which of your systems run Synacor Zimbra Collaboration Suite, at which version, fixed or not - and what each one needs.
Main sources
[NEU] [hoch] Synacor Zimbra Collaboration Suite: Mehrere Schwachstellen CERT · [UPDATE] [hoch] Synacor Zimbra: Mehrere Schwachstellen CERT · [UPDATE] [kritisch] Synacor Zimbra: Mehrere Schwachstellen CERT