Security Center - Zimbra :: Tech Center (original) (raw)

How to stay informed about security announcements?

You could manually check this page: https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

And/or subscribe to the these RSS feeds (you can use Zimbra Classic UI or some other feedreader like r2e on Linux):

• https://wiki.zimbra.com/security-advisory-feed.php (no details, can be used for security notification purposes)
• https://blog.zimbra.com/feed/ (includes patches and security news with details and other news)

ZCS 10.1.16 Released

ZCS 10.1.16 was released on Wed Feb 04 2026. The release includes security fixes for:

• Restored mail rendering stability while maintaining the existing security protections.
• Addressed a XSS vulnerability in zimbra webmail CVE-2026-33368
• Fixed an authenticated LDAP injection vulnerability by sanitizing user-controlled input. CVE-2026-33369
• PDF attachment preview functionality has been restored in the Classic UI while maintaining security protections.
• Addressed a stored XSS vulnerability in the Briefcase feature caused by inline rendering of specific uploaded file types when shared publicly. CVE-2026-33370
• Addressed an authenticated XXE vulnerability in the EWS SOAP endpoint. CVE-2026-33371
• Fixed a CSRF validation issue where tokens were incorrectly accepted from the request body instead of the required header. CVE-2026-33372

ZCS 10.1.13 Released

ZCS 10.1.13 was released on Thu Nov 06 2025. The release includes security fixes for:

• Patched a stored XSS vulnerability in the Classic UI where attackers could abuse CSS @import directives in email HTML. CVE-2025-66376
• Revoked and removed hardcoded Flickr API credentials from the Flickr Zimlet. CVE-2025-67809
• Introduced path validation in the ExportAndDeleteItemsRequest API to prevent unsafe file exports.
• Addressed a missing CSRF enforcement issue in specific authentication flows. TBD
• Addressed an unauthenticated local file inclusion vulnerability in the RestFilter. CVE-2025-68645
• Fixed a stored XSS vulnerability in Zimbra Mail Client for emails with PDF attachments.
• Added input validation and null checks in the PreAuthServlet to prevent internal error disclosure on malformed requests.
• Addressed an admin account enumeration issue.
• Upgraded Apache HttpClient library to version 4.5.14 as a proactive security and maintenance measure.

ZCS 10.0.18 Released

ZCS 10.0.18 was released on Thu Nov 06 2025. The release includes security fixes for:

• Patched a stored XSS vulnerability in the Classic UI where attackers could abuse CSS @import directives in email HTML. CVE-2025-66376
• Introduced path validation in the ExportAndDeleteItemsRequest API to prevent unsafe file exports.
• Addressed a missing CSRF enforcement issue in specific authentication flows. TBD
• Addressed an unauthenticated local file inclusion vulnerability in the RestFilter. CVE-2025-68645

ZCS 10.1.12 Released

ZCS 10.1.12 was released on Thu Oct 16 2025. The release includes security fixes for:

• Addressed a Server-Side Request Forgery (SSRF) vulnerability in the chat proxy configuration. CVE-2025-62763

ZCS 10.1.10 Released

ZCS 10.1.10 was released on Fri July 18 2025. The release includes security fixes for:

• Access to the GraphiQL IDE at /modern/graphiql has been disabled.
• The @babel/runtime package has been upgraded to version 7.27.6 to address a ReDoS vulnerability. CVE-2025-27789
• Addressed a Cross-Site Request Forgery (CSRF) vulnerability in the ResetPasswordRequest SOAP operation by enforcing CSRF token validation. CVE-2025-54390
• A security fix has been applied to require a valid auth token before allowing 2FA modifications, preventing unauthorized changes. CVE-2025-54391
• The Rsync package has been upgraded to version 3.4.1 to fix multiple vulnerabilities.

ZCS 10.0.16 Released

ZCS 10.0.16 was released on Fri July 18 2025. The release includes security fixes for:

• Addressed a Cross-Site Request Forgery (CSRF) vulnerability in the ResetPasswordRequest SOAP operation by enforcing CSRF token validation. CVE-2025-54390
• A security fix has been applied to require a valid auth token before allowing 2FA modifications, preventing unauthorized changes. CVE-2025-54391
• Write access to /opt/zimbra/jetty/webapps has been restricted to enhance security and mitigate potential risks.

ZCS 10.1.9 Released

ZCS 10.1.9 was released on Wed June 18 2025. The release includes security fixes for:

• Addressed a denial of service (DoS) vulnerability in the admin console that could lead to service disruptions. CVE-2025-53645
• This patch fixes a critical security vulnerability related to stored cross-site scripting in the Zimbra Classic Web Client. The fix strengthens input sanitization and enhances security. All customers are strongly advised to upgrade to this latest patch version immediately. CVE-2025-27915

ZCS 10.0.15 Released

ZCS 10.0.15 was released on Wed June 18 2025. The release includes security fixes for:

• Addressed a denial of service (DoS) vulnerability in the admin console that could lead to service disruptions. CVE-2025-53645
• This patch fixes a critical security vulnerability related to stored cross-site scripting in the Zimbra Classic Web Client. The fix strengthens input sanitization and enhances security. All customers are strongly advised to upgrade to this latest patch version immediately. CVE-2025-27915

ZCS 9.0.0 Patch 46 Released

ZCS 9.0.0 Patch 46 was released on Wed June 18 2025. The release includes security fixes for:

• Addressed a denial of service (DoS) vulnerability in the admin console that could lead to service disruptions. CVE-2025-53645
• This patch fixes a critical security vulnerability related to stored cross-site scripting in the Zimbra Classic Web Client. The fix strengthens input sanitization and enhances security. All customers are strongly advised to upgrade to this latest patch version immediately. CVE-2025-27915

ZCS 10.1.8 Released

ZCS 10.1.8 was released on Thu May 15 2025. The release includes security fixes for:

• Addressed a denial of service (DoS) vulnerability that could lead to service disruptions. A new local config attribute, ajax_uri_max_assets_requests_allowed has been added.CVE-2025-53645
• The ClamAV package has been upgraded to version 1.0.8 to fix multiple vulnerabilities. CVE-2025-20128 CVE-2024-20505

ZCS 10.0.14

ZCS 10.0.14 was released on Thu May 15 2025. The release includes security fixes for:

• Addressed a denial of service (DoS) vulnerability that could lead to service disruptions. A new local config attribute, ajax_uri_max_assets_requests_allowed has been added.CVE-2025-53645

ZCS 9.0.0 Patch 45 Released

ZCS 9.0.0 Patch 45 was released on Thu May 15 2025. The release includes security fixes for:

• Addressed a denial of service (DoS) vulnerability that could lead to service disruptions. A new local config attribute, ajax_uri_max_assets_requests_allowed has been added.CVE-2025-53645

ZCS 10.1.6 Released

ZCS 10.1.6 was released on Mon Mar 03 2025. The release includes security fixes for:

• Write access to /opt/zimbra/jetty/webapps has been restricted to enhance security and mitigate potential risks.

ZCS 10.1.5 Released

ZCS 10.1.5 was released on Mon Jan 27 2025. The release includes security fixes for:

• This patch fixes a critical security vulnerability related to stored cross-site scripting in the Zimbra Classic Web Client. The fix strengthens input sanitization and enhances security. All customers are strongly advised to upgrade to this latest patch version immediately. TBD

ZCS 10.0.13 Released

ZCS 10.0.13 was released on Mon Jan 27 2025. The release includes security fixes for:

• This patch fixes a critical security vulnerability related to stored cross-site scripting in the Zimbra Classic Web Client. The fix strengthens input sanitization and enhances security. All customers are strongly advised to upgrade to this latest patch version immediately. TBD

ZCS 9.0.0 Patch 44 Released

ZCS 9.0.0 Patch 44 was released on Mon Jan 27 2025. The release includes security fixes for:

• This patch fixes a critical security vulnerability related to stored cross-site scripting in the Zimbra Classic Web Client. The fix strengthens input sanitization and enhances security. All customers are strongly advised to upgrade to this latest patch version immediately. TBD

ZCS 10.1.4 Released

ZCS 10.1.4 was released on Tue Dec 17 2024. The release includes security fixes for:

• An issue with encoded @import statements in