Rapid7 has disclosed 17 vulnerabilities in the Zimbra Collaboration Suite (ZCS) that cross identity and privilege boundaries, according to a single-outlet report published around October 26 and 27. The exact Rapid7 publication date is not stated in that source.
The flaws span web client sanitization, calendar processing, LDAP lookups and Linux sudo configuration. An attacker holding one low-privileged account can chain them to hijack sessions through cross-site scripting, read other users’ mailboxes or escalate locally to root.
Cross-Site Scripting Flaws Led by CVE-2026-50053 and CVE-2026-93639
Two of the web client bugs carry a CVSS score of 8.7. CVE-2026-50053 chains a request attribute override with an unencoded packages parameter in the /h/rest document editor, and lets an authenticated attacker run JavaScript in another signed-in user’s session. CVE-2026-93639 is a cross-account XSS flaw exploitable by a delegated administrator.
Lower-Severity Web Client Bypasses in CVE-2026-93638, CVE-2026-93633 and CVE-2026-93630
CVE-2026-93638, scored 6.1, is an unauthenticated XSS on the login page through the zrememberme parameter during a two-factor relogin error. CVE-2026-93633, scored 5.4, is a DefangFilter CSS bypass using non-ASCII Briefcase documents. CVE-2026-93630, scored 4.3, is a form-action bypass using percent-encoded hostnames.
Three Passwordless Sudo Paths Give the zimbra Account Root
Three local privilege escalation flaws, each rated CVSS 7.8, let the Unix zimbra account reach root through passwordless sudo rules.
CVE-2026-93640 in the zmunbound Wrapper
CVE-2026-93640 involves the zmunbound wrapper in the optional dnscache package, which forwards arbitrary arguments to Unbound.
CVE-2026-50057 and CVE-2026-50056 in Postfix and zmmailboxdmgr
CVE-2026-50057 involves the Postfix daemon_directory setting combined with postfix set-permissions. CVE-2026-50056 involves unrestricted JVM arguments in the zmmailboxdmgr launcher. In all three cases the attacker would first need to be operating as the zimbra user on the server.
No Exploitation Confirmed and Zimbra Patch Releases Available
The report states that there is no public proof-of-concept and no confirmed exploitation in the wild. Zimbra patch releases are available, and the report does not give a count of exposed servers. Because the account comes from one outlet, the CVE details and scores should be matched against Rapid7’s own disclosure and Zimbra’s release notes.
Why Zimbra Mail Servers Draw Attackers
Email servers are frequent targets for espionage and initial access, and the chain described here shows how a single low-privileged account could widen to other users’ mailboxes or to the host itself. The report recommends applying the latest Zimbra patch releases and auditing sudo and server configuration.
The 17 flaws touch separate components, from the login page to the dnscache package, so the disclosure covers a wide slice of the product rather than one subsystem.
Timeline and Source Caveats for the Rapid7 Zimbra Disclosure
The disclosure was reported on October 26 and 27, though the source does not give Rapid7’s exact publication date. All the details here come from a single outlet’s article, which is why the CVE identifiers and scores are presented as reported and not independently checked.
The report treats the 17 flaws as a group because of how they connect. Web client sanitization problems and calendar processing issues let an attacker act as another signed-in user. The LDAP lookup weaknesses and cross-account flaws extend that reach to other users’ mailboxes. The sudo configuration problems then provide a route from the Unix zimbra account to root on the server.
That sequence matters because the starting point is only one low-privileged account. The report describes three outcomes available to an attacker holding such an account: session hijacking through cross-site scripting, reading other users’ mailboxes, and local escalation to root.
The report states that Zimbra patch releases are available. It recommends applying the latest releases and auditing sudo and server configuration, and it gives no count of exposed servers. No public proof of concept and no exploitation in the wild have been confirmed.
