Zimbra : Blog (original) (raw)

https://blog.zimbra.com/All Things Zimbra Thu, 28 May 2026 09:31:58 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.4 Patch Release Update: Zimbra 10.1.17 https://blog.zimbra.com/2026/05/patch-release-update-zimbra-10-1-17/https://blog.zimbra.com/2026/05/patch-release-update-zimbra-10-1-17/#respond Thu, 28 May 2026 09:31:58 +0000 https://blog.zimbra.com/?p=14378 Patch Security Severity: Medium Deployment Risk: Low We have released Zimbra Version 10.1.17, bringing meaningful improvements across the Modern WebClient — from how you compose and read email to how you schedule meetings — along with fixes for ZCO, mobile, and server components, and several important security patches your teams should be aware of. Zimbra 10.1.17 […]

The post Patch Release Update: Zimbra 10.1.17 appeared first on Zimbra : Blog.

]]> Patch Security Severity: Medium

Deployment Risk: Low

We have released Zimbra Version 10.1.17, bringing meaningful improvements across the Modern WebClient — from how you compose and read email to how you schedule meetings — along with fixes for ZCO, mobile, and server components, and several important security patches your teams should be aware of.

Zimbra 10.1.17 (Release Notes)

We strongly recommend all admins and users to upgrade for improved stability and enhanced email compatibility.

What’s New in 10.1.17

Voice Composer for Email: Dictate emails hands-free with system language detection and spoken punctuation — available in new, reply, and forward views. Enabled by admins via the voice-composer Zimlet.
Smarter Calendar Scheduling: A redesigned event creation flow reduces scrolling for quicker scheduling. The new “Suggest a Time” feature shows participant availability and recommends optimal meeting slots as attendees are added.
Enhanced Email Experience: View the latest emails first with a new thread order setting. Attachments are pinned to a dedicated top panel in thread view, and the composer now supports drag-and-drop attachments, multi-signature, and autosave with a cleaner layout.
2FA on Login Page: QR code now shown directly at login when 2FA is enforced, removing the need to visit preferences first.
Desktop App Upgraded: Electron updated from 37 to 41, bringing improved security, performance, and compatibility with newer Chromium and Node.js versions.
Ubuntu 24: Now fully supported as a GA release.

Security Patches

Delegated Send Hardened: Fixed an authorization bypass that could allow authenticated users to send emails impersonating other users.
Classic UI Attachment Preview Secured: Fixed a stored XSS vulnerability where malicious email attachments could execute scripts when previewed.
LFI Vulnerabilities Patched: Closed both an authenticated LFI in Briefcase via the packages parameter, and an unauthenticated LFI in Classic UI via the fu parameter.
EWS Endpoint Protected:Fixed a CSRF vulnerability that could allow unauthorized actions to be performed on behalf of authenticated users.
Document Editing Token Security Improved: Fixed weak random number generation for zimbraDocumentEditingJwtSecret, which was susceptible to offline brute-force attacks.

RHEL 9 and Ubuntu 22: SSHA256 password hashes on these platforms may cause authentication failures after password changes or migrations. Reset affected user passwords post-upgrade to restore access — passwords generated after the fix will be created correctly.

Key Bug & Improvements

Mailbox Data Protected Post-migration: zmpurgeoldmbox now safely skips blobs still referenced by active mailboxes, eliminating a data loss risk after mailbox migration.
Mailbox Quota Bypass via IMAP Copy to Trash: A configurable soft limit keeps mailbox size in check, preventing unchecked growth from repeated IMAP copy operations.
ZCO Delegated Send: Emails sent via Send As are now correctly saved in the delegated account’s Sent folder, and forwarded messages preserve their original formatting.
Samsung Email: Contacts sync now sync consistently for datasets over 1,000 contacts.
iOS Calendar: Events stay visible after accepting an invite, even when auto-add invites is disabled. Responses are also correctly sent to the organizer now.
Mobile App: Attachments in the Zimbra mobile app now download successfully without getting stuck.
Modern WebClient: PDF multi-page preview, print (Ctrl+P), and local contact autocomplete all fixed.

Additional Fixed Issues

20+ additional fixes across Admin Console, Chat, ZCO, Backup, and Zimbra Desktop including filter rule duplication, search highlighting, keyboard shortcuts, Admin Console localisation, and chat performance.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.17 appeared first on Zimbra : Blog.

]]> https://blog.zimbra.com/2026/05/patch-release-update-zimbra-10-1-17/feed/ 0 Product Advisory: zmpurgeoldmbox May Delete External Storage Blobs After Mailbox Migration https://blog.zimbra.com/2026/03/product-advisory-zmpurgeoldmbox-may-delete-external-storage-blobs-after-mailbox-migration/ Fri, 27 Mar 2026 05:39:58 +0000 https://blog.zimbra.com/?p=14367 Applies to: Zimbra Collaboration Suite 10.1.15, 10.1.16 with external object storage (Scality, S3, OpenIO) Summary A regression in ZCS 10.1.15 causes zmpurgeoldmbox to delete external blobs (Scality, S3, OpenIO) after mailbox migration, even when zimbraMailboxMoveSkipBlobs=TRUE. This results in permanent, irrecoverable email data loss on the destination server. A fix is targeted for the 10.1.17 patch release. Until then, do not run zmpurgeoldmbox after mailbox migrations if you […]

The post Product Advisory: zmpurgeoldmbox May Delete External Storage Blobs After Mailbox Migration appeared first on Zimbra : Blog.

]]> Applies to: Zimbra Collaboration Suite 10.1.15, 10.1.16 with external object storage (Scality, S3, OpenIO)

Summary

A regression in ZCS 10.1.15 causes zmpurgeoldmbox to delete external blobs (Scality, S3, OpenIO) after mailbox migration, even when zimbraMailboxMoveSkipBlobs=TRUE.
This results in permanent, irrecoverable email data loss on the destination server.
A fix is targeted for the 10.1.17 patch release.
Until then, do not run zmpurgeoldmbox after mailbox migrations if you use external or unified object storage.

What Happened

In ZCS 9.0, running zmpurgeoldmbox after a zmmboxmove correctly cleaned up only local metadata (MySQL + Lucene indexes) on the source server, leaving external blobs untouched. In ZCS 10.1.15, a code change inadvertently altered the logic that identifies external/centralized storage. As a result:

zmpurgeoldmbox now deletes external blobs even without the –forceDeleteBlobs flag
The destination server’s mailbox still references those deleted blobs
Affected users see “missing blob” errors and lose access to their emails permanently

Am I Affected?

You are affected if all of the following are true:

You are running ZCS 10.1.15 or 10.1.16
You use external object storage (Scality, S3, OpenIO, or similar) as a primary or secondary (HSM) volume — especially with unified storage enabled
You perform mailbox migrations using zmmboxmove with blob-skipping attributes (zimbraMailboxMoveSkipBlobs=TRUE or zimbraMailboxMoveSkipHsmBlobs=TRUE)
You run zmpurgeoldmbox on the source server after migration

If you use only local (internal) storage and no external object storage, this issue does not affect you.

Behavior Comparison: ZCS 9.0 vs 10.1.15

Scenario	ZCS 9.0	ZCS 10.1.15 (Bug)
External/unified storage, no –forceDeleteBlobs	Blobs preserved	Blobs DELETED
External/unified storage, with –forceDeleteBlobs	Blobs preserved *	Blobs DELETED
Internal (local) storage only	Blobs deleted (expected)	Blobs deleted (expected)

* In ZCS 9.0, –forceDeleteBlobs was not implemented for external stores (Bug 96149). It is being properly implemented as part of the fix.

Immediate Workaround

Do not run zmpurgeoldmbox (or PurgeMovedMailboxRequest via SOAP) after mailbox migrations if your environment uses external object storage.
Disable any automation or scripts that trigger zmpurgeoldmbox as part of post-migration cleanup.
Skipping the purge leaves residual local metadata (MySQL + Lucene) on the source server. This is harmless and can be cleaned up after the patch is applied.
zmmboxmove itself is not affected — mailbox migrations continue to work correctly. Only the post-migration purge step is problematic.

The Fix

The corrected behavior in 10.1.17 will be:

Storage Type	Without –forceDeleteBlobs	With –forceDeleteBlobs
Internal (local)	Blobs deleted	Blobs deleted
External (non-unified)	Blobs preserved	Blobs deleted
External (unified)	Blobs preserved	Blobs deleted

External blobs will only be deleted with an explicit –forceDeleteBlobs flag.
Targeted release: ZCS 10.1.17 patch.
If you need an early-access build, contact Zimbra Support.

What To Do Next

Immediately stop running zmpurgeoldmbox after mailbox migrations in any environment with external storage. Disable related automation.
Audit recent migrations: if zmpurgeoldmbox was already run, verify blob integrity on the destination server using:

zmprov gmi user@example.com

zmblobchk -m -v –output-used-blobs start

If the output shows “blob not found” errors for external locators (containing @@), those blobs have been deleted.

If data loss has occurred, check if your object storage provider supports versioning or soft-delete, there may be a recovery path.
Plan for the 10.1.17 patch: after upgrading, you can safely resume zmpurgeoldmbox and clean up residual metadata from the workaround period.

Questions?

If you have questions, please contact Zimbra Support.

Affected versions: ZCS 10.1.15 through 10.1.16 (all editions)

Fix version: ZCS 10.1.17 (targeted)

Tracking reference: ZBUG-5265

Severity: Critical — potential data loss

The post Product Advisory: zmpurgeoldmbox May Delete External Storage Blobs After Mailbox Migration appeared first on Zimbra : Blog.

]]> Patch Release Update: Zimbra 10.1.16 https://blog.zimbra.com/2026/02/patch-release-update-zimbra-10-1-16/ Wed, 04 Feb 2026 10:06:56 +0000 https://blog.zimbra.com/?p=14351 We heard you! Enhanced Backup and Restore has been a top request from your customers, and from you. We know how critical this is for your deployments, and we’re grateful you stayed with us while we delivered on the commitment we made on our product roadmap. Stay tuned — more of those roadmap features are […]

The post Patch Release Update: Zimbra 10.1.16 appeared first on Zimbra : Blog.

]]> We heard you! Enhanced Backup and Restore has been a top request from your customers, and from you. We know how critical this is for your deployments, and we’re grateful you stayed with us while we delivered on the commitment we made on our product roadmap. Stay tuned — more of those roadmap features are coming throughout 2026.

In addition, this patch addresses multiple security vulnerabilities and Modern Web App improvements designed to streamline your email management and collaboration.

Patch Security Severity: High

Deployment Risk: High

Zimbra 10.1.16 (Release Notes)

We strongly recommend all admins and users to upgrade to Zimbra 10.1.16 for improved stability and enhanced email compatibility.

What’s New in 10.1.16

This release introduces major enhancements to the Backup & Restore module, delivering massive gains in performance and disk usage efficiency. Customers can experience up to 50% faster backup performance and up to 45% reduction in storage consumption, while maintaining full backward compatibility.

Backup and Restore Enhancements

Enhanced deduplication: Deduplication now applies to data stored on both internal and external (S3) storage, eliminating redundant data. This is enabled by default for new backups.
Improved Compression: Introduces Zstandard (zstd) compression for deduplicated backups, delivering superior results with lower resource usage.
Optional Cross-Session Deduplication: Reuse unchanged data across backup runs for even greater efficiency.
Full Backward Compatibility: All existing backups remain restorable; new and legacy backups coexist seamlessly.

For more details on the enhancements, configuration details, and upgrade guidance, see our Backup and Restore section in the admin guide.

Security Fixes

This release includes important security enhancements and stability improvements:

Restored mail rendering stability while maintaining existing security protections
Resolved XSS vulnerability in Zimbra Webmail and Briefcase file sharing
Fixed authenticated LDAP injection through improved input sanitization
Restored PDF preview functionality in Classic UI with security safeguards
Addressed XXE vulnerability in EWS SOAP endpoint
Strengthened CSRF protection with proper token validation

Key Modern Web App Improvements

Email Translation (Chrome only): Instantly translate emails into your preferred language with auto-detection and easily switch back to original anytime. Admins can enable/disable via Zimlets at COS or user level.
Smarter Search: Faster, more intuitive search with improved Advanced Search filters and the ability to combine search options for precise results.

Ubuntu 24 Support (Beta)

Ubuntu 24 Support (Beta) is now available with this release.

Beta Notice: Beta features are unsupported and intended for lab/testing environments only. Do not deploy on production systems.

Additional Improvements and Fixed Issues

Modern Web App Improvements

Enhanced Briefcase: Create new documents directly in Modern Web App and seamlessly open files from Classic Web App with full content integrity.
Visual Navigation Upgrade: Consistent, recognizable icons across Inbox, Drafts, Sent, Trash, and shared folders for easier mail management.
Custom Tag Colors: Organize messages visually with customizable tag colors that sync across all devices.
Improved Image Preview: Pan and zoom on images with smooth click-and-drag functionality across all devices.
Zoom Integration: Schedule and manage Zoom meetings directly from Zimbra with refreshed, reliable integration.

Additional Fixed Issues

20+ bug fixes across Modern Web App, Classic Web App, ActiveSync, EWS, Chat, and Zimbra Desktop improving stability and user experience.

Customer Feedback Portal

The post Patch Release Update: Zimbra 10.1.16 appeared first on Zimbra : Blog.

]]> Patch Release Update: Zimbra 10.1.15 https://blog.zimbra.com/2025/11/patch-release-update-zimbra-10-1-15/ Tue, 25 Nov 2025 08:35:28 +0000 https://blog.zimbra.com/?p=14341 Patch Security Severity: Low Deployment Risk: Low We have released Zimbra Version 10.1.15, improving email rendering compatibility while maintaining critical security protections. Zimbra 10.1.15 (Release Notes) We strongly recommend all admins and users to upgrade to Zimbra 10.1.15 for improved stability and enhanced email compatibility. End of Life Notice: 10.0 Zimbra 10.0 will reach End of […]

The post Patch Release Update: Zimbra 10.1.15 appeared first on Zimbra : Blog.

]]> Patch Security Severity: Low

Deployment Risk: Low

We have released Zimbra Version 10.1.15, improving email rendering compatibility while maintaining critical security protections.

Zimbra 10.1.15 (Release Notes)

We strongly recommend all admins and users to upgrade to Zimbra 10.1.15 for improved stability and enhanced email compatibility.

End of Life Notice: 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

The post Patch Release Update: Zimbra 10.1.15 appeared first on Zimbra : Blog.

]]> Emergency Patch Release: Zimbra 10.1.14 https://blog.zimbra.com/2025/11/emergency-patch-release-zimbra-10-1-14/ Wed, 12 Nov 2025 06:01:45 +0000 https://blog.zimbra.com/?p=14331 EMERGENCY SECURITY PATCH We have released Zimbra Version 10.1.14 to address a critical issue in Version 10.1.13 that impacts IMAP synchronization across multi-server Zimbra environments, causing incorrect message display and synchronization failures. For complete details and implementation guidance, please refer to our release notes: Zimbra 10.1.14 (Release Notes) Customers on Version 10.1.13 Patch Security Severity: Low […]

The post Emergency Patch Release: Zimbra 10.1.14 appeared first on Zimbra : Blog.

]]> EMERGENCY SECURITY PATCH

We have released Zimbra Version 10.1.14 to address a critical issue in Version 10.1.13 that impacts IMAP synchronization across multi-server Zimbra environments, causing incorrect message display and synchronization failures.

For complete details and implementation guidance, please refer to our release notes:

Zimbra 10.1.14 (Release Notes)

Customers on Version 10.1.13

Patch Security Severity: Low

Deployment Risk: Low

We strongly encourage all customers with a high IMAP user base who have upgraded to Version 10.1.13 to upgrade to Zimbra 10.1.14 immediately. Customers on Version 10.1.13 with a low IMAP usage pattern may continue using the current version and wait for the upcoming Version 10.1.15.

Customers on Version 10.1.12 or earlier

Patch Security Severity: High

Deployment Risk: Low

Customers currently on Patch Version 10.1.12 or earlier are recommended to upgrade directly to Version 10.1.14 for improved stability and fixes.

This new patch version also resolved slowdown issues when switching to the Zimbra user post-upgrade to Version 10.1.13. User switching is now significantly faster and more responsive through optimized license data caching.

End of Life Notice: Zimbra 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

The post Emergency Patch Release: Zimbra 10.1.14 appeared first on Zimbra : Blog.

]]> Patch Release Update: Zimbra 10.1.13, 10.0.18 https://blog.zimbra.com/2025/11/patch-release-update-zimbra-10-1-13-10-0-18/ Thu, 06 Nov 2025 08:50:45 +0000 https://blog.zimbra.com/?p=14318 Patch Security Severity: High Deployment Risk: Medium This patch fixes a stored cross-site scripting (XSS) vulnerability and enhances protection by upgrading AntiSamy to version 1.7.8 and removing the outdated code. It includes critical fixes and user experience improvements for the following editions: Zimbra 10.1.13 (Release Notes) Zimbra 10.0.18 (Release Notes) We recommend all administrators and users […]

The post Patch Release Update: Zimbra 10.1.13, 10.0.18 appeared first on Zimbra : Blog.

]]> Patch Security Severity: High

Deployment Risk: Medium

This patch fixes a stored cross-site scripting (XSS) vulnerability and enhances protection by upgrading AntiSamy to version 1.7.8 and removing the outdated code. It includes critical fixes and user experience improvements for the following editions:

We recommend all administrators and users to apply this update to strengthen your system’s stability and ensures uninterrupted service performance.

What’s New in 10.1.13

Communication & Collaboration

Ignite: Smart email search with instant suggestions and LDAP-supported external email warning
Modern Web App: Improved drag-and-drop, calendar management, tag organization, dumpster functionality, and POP/IMAP settings in Modern UI
Zimbra Connector for Outlook (ZCO): Outlook 2024 compatibility, better meeting proposals and shared folder handling
ActiveSync & Exchange Web Services (EWS): Reliable iOS attachments and consistent calendar sync across all devices. Following Microsoft’s recent announcement extending Legacy EWS support to October 2026 (from the previous October 2025 deadline), Zimbra will maintain EWS compatibility across all currently supported Outlook versions, ensuring uninterrupted service for Outlook clients using this protocol.
Chat and Video: Chat zimlets and extensions have been updated with the latest improvements. Chat installer zfzi-2.0.1 is now available, and the customization version has been updated to 10.2.1, bringing enhanced performance and bug fixes.

Modern UI Enhancements

POP/IMAP Management: Users can now manage email access settings directly from Modern Webmail, including on mobile.
Copy-Paste Formatting: Content from Excel, PowerPoint, Word, and web pages now keeps its formatting when pasted into emails.
Meeting Control: Meeting organizers can now customize cancellation messages and choose to cancel single meetings or entire series. Users now have ‘Edit Message’ option to personalize their messages before responding.
Enhanced Recovery: Restore deleted emails, contacts, appointments, and files directly from Trash.
Quick Distribution List View: See all members of a distribution list instantly from the message preview without having to switch views.
Improved Tags: Tags now work consistently across all features with bug fixes.
Drag-and-Drop Uploads: Easily drag files into Briefcase, just like in Classic UI.
One-Click Recipient Removal: Remove any recipient (To, Cc, Bcc, or invitee) by clicking the “X” next to their name across Mail, Calendar, Briefcase, and Contacts.
Redesigned Tag Management: Cleaner interface makes creating and organizing tags easier with better visuals and accessibility.
Visual Drop Indicators: Clear highlighting shows exactly where items will land when dragging and dropping across Mail, Briefcase, and Contacts.

Security Updates

Enhanced S3 data management and cleanup for mailbox moves
Strengthened TLS handling per updated RFC standards

Performance Optimizations

Faster email thread loading with Smart Conversation Loading
Improved performance for large folders sets in Mail and Briefcase
Optimized Briefcase memory management

End of Life Notice: 10.0

Customer Feedback Portal

The post Patch Release Update: Zimbra 10.1.13, 10.0.18 appeared first on Zimbra : Blog.

]]> Emergency Patch Release: Zimbra 10.1.12 https://blog.zimbra.com/2025/10/patch-release-update-zimbra-10-1-12/ Thu, 16 Oct 2025 08:40:56 +0000 https://blog.zimbra.com/?p=14310 EMERGENCY SECURITY PATCH Patch Security Severity: High Deployment Risk: Low This patch fixes a critical security vulnerability related to a Server-Side Request Forgery (SSFR) in the chat proxy configuration. We recommend all users and administrators, especially those on Zimbra versions 10.1.5 to 10.1.11 to apply this update immediately. It will strengthen your system’s stability and ensures […]

The post Emergency Patch Release: Zimbra 10.1.12 appeared first on Zimbra : Blog.

]]> EMERGENCY SECURITY PATCH

Patch Security Severity: High

Deployment Risk: Low

This patch fixes a critical security vulnerability related to a Server-Side Request Forgery (SSFR) in the chat proxy configuration.

We recommend all users and administrators, especially those on Zimbra versions 10.1.5 to 10.1.11 to apply this update immediately. It will strengthen your system’s stability and ensures uninterrupted service performance:

Zimbra 10.1.12 (Release Notes)

Customer Feedback Portal

The post Emergency Patch Release: Zimbra 10.1.12 appeared first on Zimbra : Blog.

]]> Patch Release Update: Zimbra 10.1.11, 10.0.17 https://blog.zimbra.com/2025/08/patch-release-update-zimbra-10-1-11-10-0-17/ Fri, 08 Aug 2025 10:39:18 +0000 https://blog.zimbra.com/?p=14300 Patch Security Severity: Low Deployment Risk: Low This patch updated on August 8th, 2025 includes hotfix for the following editions: Zimbra 10.1.11 (Release Notes) Zimbra 10.0.17 (Release Notes) Hotfix for 10.1.11 & 10.0.17 ActiveSync: Resolves an issue that was affecting the iOS Mail app, ensuring improved functionality for all users. We recommend applying this hotfix for a […]

The post Patch Release Update: Zimbra 10.1.11, 10.0.17 appeared first on Zimbra : Blog.

]]> Patch Security Severity: Low

Deployment Risk: Low

This patch updated on August 8th, 2025 includes hotfix for the following editions:

Hotfix for 10.1.11 & 10.0.17

ActiveSync: Resolves an issue that was affecting the iOS Mail app, ensuring improved functionality for all users. We recommend applying this hotfix for a seamless experience.

Customer Feedback Portal

The post Patch Release Update: Zimbra 10.1.11, 10.0.17 appeared first on Zimbra : Blog.

]]> Patch Release Update: Zimbra 10.1.10, 10.0.16 https://blog.zimbra.com/2025/07/patch-release-update-zimbra-daffodil-10-1-10-10-0-16/ Fri, 18 Jul 2025 08:34:42 +0000 https://blog.zimbra.com/?p=14242 Patch Security Severity: Medium Deployment Risk: Low This patch updated on July 18th, 2025 focuses on essential fixes and user experience improvements for the following editions: Zimbra 10.1.10 (Release Notes) Zimbra Daffodil 10.0.16 (Release Notes) End of Life (EOL) Notice Zimbra Daffodil 10.0: Zimbra Daffodil 10.0 reached the end of General Support on June 30th, […]

The post Patch Release Update: Zimbra 10.1.10, 10.0.16 appeared first on Zimbra : Blog.

]]> Patch Security Severity: Medium

Deployment Risk: Low

This patch updated on July 18th, 2025 focuses on essential fixes and user experience improvements for the following editions:

End of Life (EOL) Notice

Zimbra Daffodil 10.0: Zimbra Daffodil 10.0 reached the end of General Support on June 30th, 2025, and is set to reach EOL on December 31st, 2025. No further updates will be provided after this date. Customers using these versions are advised to plan their migration to the 10.1 version to ensure continued security updates and access to the latest features.

Zimbra 9.0: Zimbra 9.0 reached EOL on June 30th, 2025.

We strongly recommend upgrading to a supported version like Zimbra 10.1 to maintain security, performance, and access to our dedicated support. We’re here to help make this transition as smooth as possible:

Migration Guides: Access comprehensive resources to guide your upgrade.
Personalized Assistance: Need a hand? Our team is ready to assist you.

CentOS 7, RHEL 7, and Oracle Linux 7

RHEL7 and CentOS 7 reached EOL in June 2024, and Oracle Linux 7 in December 2024.

Zimbra will deprecate support for these operating systems following the release of Zimbra 10.1.10 by July 2025. After this release, no further updates, patches, or official support will be provided for RHEL/CentOS/Oracle 7 operating systems.

We recommend upgrading to RHEL/Rocky/Oracle Linux 9. For assistance, please contact our Support team.

Things to know before you upgrade

Changes to SpamAssassin

Apache SpamAssassin has been upgraded to version 4.0.1 to fix multiple bugs. If you have made custom changes to this file, please back up your current file before the upgrade and after the upgrade, re-apply your changes manually to the new salocal.cf.in. Please refer to the Release Notes for more details.

What’s New in 10.1.10

User Interface (UI) & Usability:

Password expiry reminder

This feature allows system administrators to enable password expiry reminders for users so that they are informed about the upcoming password expiration of their account and accordingly can take the required action.

Modern UI Enhancements

Display a tag icon in the message list

Tagged emails and conversations threads will now display a tag icon directly in the message list, positioned near the attachment icon.

Improved Dark Mode

Previously, mail contents was not visible as expected in dark mode. Modern UI dark theme has been improved to ensure mail contents are displayed correctly.

Smart Scroll Handling

The chat interface now auto-scrolls to new messages, even in active conversations.

Preview markdown files in Modern UI

This feature supports previewing attached Markdown (.md) files directly within the Modern UI. Users can view Markdown content seamlessly in side panel, files stored in Briefcase and included in calendar invites.

Security

Block attachment downloads

Modern UI The “zimbraAttachmentsBlocked” attribute now works as expected for the Modern UI. When it is set to true, it blocks attachment downloads for the emails with attachments.

Provide a new option to update the digital certificate for S/MIME

Users can now not only upload but also replace or remove the digital uploaded S/MIME certificate.

Communication & Collaboration

ZCO / ActiveSync / EWS

Multiple enhancements and fixes in calendaring, sharing, delegation, and mail syncing with Outlook and other Apps.

Chat

Core Platform Enhancements: massive domain provisioning, internationalization for Classic UI, Zimbra Desktop integration, Chat data preservation
Usability & Operational Improvements: General UX polish, Dark Mode improvements, Smart Scroll handling

Security Fix – 10.1.10 & 10.0.16

GraphiQL IDE Disabled: For enhanced security, the accessible GraphiQL IDE has been disabled.
Dependency Updates: We’ve upgraded the @babel/runtime package to resolve a ReDoS vulnerability.
Authentication & Password Security:
- Addressed a CSRF vulnerability found on the Reset Password Endpoint.
- Fixed an issue allowing Two-Factor Authentication bypass through unauthorized 2FA modification.
Rsync Package Update: The rsync package has been updated to patch multiple vulnerabilities.

Refer to our Zimbra Security Center to ensure your system is safe.

Fixed Issues – 10.1.10

Zimbra, Modern UI, Classic UI, and Admin Console
Zimbra Connector for Outlook (ZCO)
ActiveSync and EWS
Backup&Restore Improvements & Migrations
Chat
Third party upgrade

Customer Feedback Portal

The post Patch Release Update: Zimbra 10.1.10, 10.0.16 appeared first on Zimbra : Blog.

]]> Emergency Patch Release: Zimbra Daffodil 10.1.9, 10.0.15 and Zimbra 9.0.0 P46 https://blog.zimbra.com/2025/06/emergency-patch-release-zimbra-daffodil-10-1-9-10-0-15-and-zimbra-9-0-0-p46/ Wed, 18 Jun 2025 08:13:35 +0000 https://blog.zimbra.com/?p=14179 Patch Security Severity: High Deployment Risk: Low This patch updated on June 18, 2025 focuses on essential security fixes for the following editions: Zimbra Daffodil 10.1.9 (Release Notes) Zimbra Daffodil 10.0.15 (Release Notes) 9.0.0 P46 (Release Notes) Security Fix – 10.1.9, 10.1.15, 9.0.0 P46 Addressed a XSS attack with ICS file in Classic UI Addressed a denial […]

The post Emergency Patch Release: Zimbra Daffodil 10.1.9, 10.0.15 and Zimbra 9.0.0 P46 appeared first on Zimbra : Blog.

]]> Patch Security Severity: High

Deployment Risk: Low

This patch updated on June 18, 2025 focuses on essential security fixes for the following editions:

Security Fix – 10.1.9, 10.1.15, 9.0.0 P46

Addressed a XSS attack with ICS file in Classic UI
Addressed a denial of service (DoS) vulnerability on Admin Console

Please note that this is the final patch release for:

After this date, no further updates will be provided to the 10.0.x and 9.0 editions.

We’re Here to Support Your Migration

We strongly recommend upgrading to a supported version like Zimbra Daffodil 10.1 to maintain security, performance, and access to our dedicated support. We’re here to help make this transition as smooth as possible:

Migration Guides: Access comprehensive resources to guide your upgrade.
Personalized Assistance: Need a hand? Our team is ready to assist you.

To ensure you benefit from the most secure and advanced solutions, please note the upcoming product lifecycle updates for the following Zimbra editions:

Upgrade Documents

Non-NG setup

In-Place Upgrade Guide (Single and Multi-Node setup)

Rolling-Upgrade Guide (Multi-Node setup)

NG setup – For 9.0.0, 8.8.15 (Network and FOSS)

In-Place Upgrade Multi-Node | In-Place Upgrade Single-Node

Rolling Upgrade Multi-Node | Rolling Upgrade Single-Node

For assistance during this transition, contact Zimbra Support.

Zimbra Daffodil 10.1 is the active and supported version.

CentOS/RHEL 7 OS and Oracle Linux 7

It is equally important to install operating system security updates and have Zimbra run on supported operating systems. After July 1, 2025, RHEL/CentOS 7 and Oracle Linux 7 will no longer be supported for Zimbra.

We recommend upgrading to RHEL/Rocky/Oracle Linux 9. If you have questions or need guidance with upgrading your operating system, please open a support case through the Zimbra Support.

We continuously offer our Buy One, Get One promotion on Zimbra Advanced Chat.

Key Offer Details:

Minimum purchase: 25 users
Validity: Offer is valid till 31 December, 2025
Eligibility: New purchases only
Version Compatibility: Available for Zimbra version 10.1.7 or greater
License Type: No mix-and-match of subscription and perpetual terms
Renewals: After the promotion period, renewals will be at the regular price Request for Quote

#ICYMI (In-Case-You-Missed-It)

New License Key Required for Zimbra Daffodil 10.1

It is mandatory to obtain a new license key to run the Zimbra Daffodil 10.1 software.
You will not be able to proceed without a new Zimbra Daffodil V10.1 license key (including trial license). Watch the video or read the blog to find out more.

YouTube link to License Management Video

Refer to the release notes for the patch installation on Red Hat and Ubuntu platforms.

An upgrade to the latest patch for your version is highly recommended. Refer to our blog and the Zimbra Security Center for steps to ensure your system is safe.

Customer Feedback Portal

The post Emergency Patch Release: Zimbra Daffodil 10.1.9, 10.0.15 and Zimbra 9.0.0 P46 appeared first on Zimbra : Blog.

]]>