Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Summary: Zimbra patched nine vulnerabilities in version 10.1.20, led by a command injection flaw in the SNMP monitoring component that applies when SNMP notifications are enabled, plus four cross-site scripting flaws in the Classic Web Client. The release also fixes a mail forwarding restriction bypass (CVE-2026-50055) that could let authenticated users exfiltrate email despite forwarding restrictions, credited to Rapid7 researcher Jonah Burgess, and comes a little over a week after Zimbra patched a critical stored XSS flaw in the Classic Web Client that could result in arbitrary code execution.
Why it matters: None of these nine flaws is flagged as actively exploited, but XSS bugs in Zimbra's email software have been repeatedly exploited by bad actors in the past, and the forwarding bypass lets an authenticated user walk email out past a restriction you turned on deliberately.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-50055
Related: ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026