Skip to content
OpenAdvisories
Critical 1 exploited CVE WID-SEC-2026-2429 4 CVEs

Synacor Zimbra: Mehrere Schwachstellen

Published Jul 20, 2026 · Updated Oct 25, 2026 · Revision 5 · de-DE

Vendor: Synacor Product: Zimbra

Summary

Ein Angreifer kann mehrere Schwachstellen in Synacor Zimbra ausnutzen, um beliebigen Programmcode auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und unbefugte Aktionen durchzuführen.

Product

Zimbra ist eine Groupware-Lösung, die E-Mail, Kalender und Aufgabenverwaltung bietet.

Vulnerabilities 4

  • High 8.9
    CVE-2026-73570 Exploited Public exploit Scanner template EPSS 77%

    A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp…

    Zimbra Collaboration
    KEV Aug 21, 2026
  • High 7.1
    CVE-2026-50054

    Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right

    An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives p…

    Zimbra Zimbra Collaboration Suite
  • Medium 6.5
    CVE-2026-10631

    Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier

    An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a …

    Zimbra Zimbra Collaboration Suite
  • Medium 6.5
    CVE-2026-50055 Public exploit

    Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion

    A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.

    Zimbra Zimbra Collaboration Suite

Revision history

  1. #5

    PoC aufgenommen CVE-2026-10631

  2. #4

    Referenz(en) aufgenommen: EUVD-2026-95097, EUVD-2026-95096, EUVD-2026-95098

  3. #3

    CVE-2026-73570 wird ausgenutzt

  4. #2

    CVE ergänzt

  5. #1

    Initiale Fassung

References