One ordinary Zimbra mailbox is enough to send mail as the CEO, read colleagues' inboxes and quietly copy future email to an outside address, according to new research from Rapid7. Senior security researcher Jonah Burgess (CryptoCat) reported more than 80 vulnerabilities in Zimbra Collaboration Suite (ZCS), the self-hosted email and calendar platform, and Rapid7 has started publishing the analysis in stages. The first installment covers five account-related flaws, three of which are already fixed.
Rapid7 has not reported any of these bugs being exploited in the wild. The risk is what they add up to: a mail server delivers password-reset links and carries mail that staff and other systems trust, so a weakness there reaches well beyond email. Zimbra servers have been a target before, most recently when attackers raided mail servers through a separate Zimbra flaw.
A forged email that passes every check
The most serious finding, CVE-2026-73571 (Rapid7 CVSS 8.3, High), sits in Zimbra's draft-saving request. A signed-in user can place another local address in the From field, and Zimbra sends the message as that account without checking for send-as rights. This is not display-name spoofing: the message travels through the organization's real outbound pipeline, so on a deployment whose legitimate mail passes SPF, DKIM and DMARC, the forgery passes too. Zimbra also files a copy in the impersonated user's Sent folder, which Rapid7 notes leaves a fabricated record of authorship. In testing, a forged message arrived as an ordinary internal email from the CEO.
Reading other people's mail through Outlook support
CVE-2026-10631 (CVSS 6.5) affects Zimbra's Exchange Web Services (EWS) extension, which provides Outlook compatibility. EWS uses folder IDs that embed the mailbox owner's account ID, and Zimbra trusted that value, so any EWS-enabled account could read complete items, including attachments, drafts, contacts and calendar entries, from other users' mailboxes with no share or delegation in place. EWS is off by default, but Rapid7 says deployments that use Zimbra's Outlook integration commonly enable it across a whole class of service.
Forwarding that survives a password reset
Administrators can block users from creating server-side forwarding rules. CVE-2026-50055 (CVSS 6.5) shows that block only stopped the Sieve redirect action, not notify, which can send selected headers and the full text body of incoming mail to any external address. The result is persistent exfiltration that keeps running after the original session expires or the victim changes their password.
Password guessing the counter cannot see
Two pre-authentication bugs remain without a public fix. CVE-2026-93637 (CVSS 3.7) lets login attempts sent through the Modern client's GraphQL endpoint skip Zimbra's per-IP failed-login counter, and many guesses can be batched into one request. Rapid7 says 10,000 candidates completed in under two minutes without the source being blocked, though it does not defeat a strong password or MFA. CVE-2026-93635 (CVSS 5.3), an LDAP filter injection, matters only on domains using external LDAP search-filter authentication with lazy provisioning, where it lets guesses evade the optional per-account lockout as well.
Upgrade to ZCS 10.1.20, then audit saved filter rules
- CVE-2026-73571 is fixed in ZCS 10.1.17; CVE-2026-10631 and CVE-2026-50055 are fixed in ZCS 10.1.20. Rapid7 advises running the latest supported release.
- Upgrading does not remove filter rules already saved to accounts. Inspect stored incoming and outgoing rules for external notify actions; Rapid7 says the Modern client's Filters view is not sufficient for this review.
- A reverse proxy or WAF that inspects request bodies can flag anonymous GraphQL requests carrying multiple authenticate aliases, and EWS logs show cross-user operations involving two different account IDs.
- Recovery from a compromise must cover saved Sieve rules, impersonated Sent items and every mailbox reached, not just the first account's password.
Proof-of-concept code and write-ups are in Rapid7's public Zimbra vulnerability tracker. Later installments will cover stored cross-site scripting in both webmail clients and paths from the document service to code execution and root. For organizations that run their own mail, the lesson of part one is that one phished employee can be a starting point for impersonating anyone in the company.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.