"in line with industry best practices, information disclosure is limited for security vulnerability fixes."
SNMP command injection in Zimbra 10.1.20
Zimbra has released version 10.1.20 to address a set of nine vulnerabilities, led by a command injection bug in the Simple Network Management Protocol (SNMP) monitoring component. According to the vendor, the issue appears when SNMP notifications are enabled and could allow injected commands to be executed via the monitoring facility. The company placed this fix at the top of the update list, identifying it as one of the most serious issues patched in the release.
Four cross-site scripting flaws in the Classic Web Client
The update also remedies four distinct cross-site scripting (XSS) vulnerabilities affecting the Classic Web Client. Zimbra’s advisory describes the flaws with narrow, functional detail:
- A stored XSS vulnerability that could allow malicious attachment filenames to execute script under specific conditions.
- An XSS vulnerability where crafted fields could execute a malicious script under specific conditions.
- An XSS vulnerability where a crafted field could execute a malicious script when rendered.
- An XSS vulnerability where crafted attachments could execute a malicious script when rendered.
Zimbra noted these were limited to the Classic Web Client and described the triggering conditions in qualified terms—“specific conditions” or “when rendered”—rather than publishing exploit details.
Mail forwarding restriction bypass — CVE-2026-50055
The company also shipped a fix for CVE-2026-50055, a mail forwarding restriction bypass that could permit authenticated users to exfiltrate email even when mail forwarding restrictions were enabled. Rapid7 researcher Jonah Burgess is credited with discovering and reporting this flaw.
Disclosure posture and recent patching cadence
Zimbra declined to publish granular technical details for the bugs, stating that, "in line with industry best practices, information disclosure is limited for security vulnerability fixes." The vendor released this set of patches a little over a week after addressing another critical stored XSS flaw in the Classic Web Client that Zimbra said could result in arbitrary code execution.
None of the vulnerabilities in the current advisory have been flagged by Zimbra as being actively exploited. Nevertheless, the company and outside observers noted that XSS defects in the product have been repeatedly exploited by bad actors in the past, a factor Zimbra invoked in urging customers to apply the updates.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Prioritize upgrading to Zimbra 10.1.20. Pay particular attention to deployments that have SNMP notifications enabled, and review mail-forwarding controls and logs for anomalous activity that might indicate prior bypass.
- Affected enterprises and procurement leaders: Factor the recent, recurring XSS fixes into patch management windows and contractual security requirements; consider whether Classic Web Client use cases expose the organization to higher risk until updates are applied.
- End users and administrators: Treat attachments and unexpected content with caution—Zimbra’s advisory highlights attachment filenames and rendered fields as vectors for script execution under specific conditions.
The technical specifics remain tightly held by the vendor, and Zimbra’s combined messaging is simple: these are fixes customers should install. While no active exploitation is reported in this advisory, the presence of a command injection in an SNMP component alongside multiple XSS paths and a mail-forwarding bypass underscores a clustered set of risks touching both monitoring and messaging functionality. For organizations using Zimbra’s Classic Web Client or running SNMP notifications, the practical step is straightforward and urgent: apply Zimbra 10.1.20 and monitor for unexpected behavior during and after the update.
