Is Zimbra safe right now?

Exploited recently

No new exploited flaws in the last 30 days, but 1 in the last 90. Make sure those updates are installed.

0exploited in the last 30 days

1in the last 90 days

0zero-days in 2026

19on CISA's list, all time

Check your version Email me when Zimbra is attacked

Exploited in the last 90 days

Zimbra Collaboration Suite (ZCS)
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
CVE-2026-73570 · listed Aug 21, 2026 · CISA deadline Aug 24, 2026

Earlier exploited flaws

Apr 20, 2026 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Mar 18, 2026 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Feb 17, 2026 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
Jan 22, 2026 Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Oct 7, 2025 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Jul 7, 2025 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
May 19, 2025 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Feb 25, 2025 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Oct 3, 2024 Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability Zero-day
Jul 27, 2023 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Zero-day
Apr 3, 2023 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Oct 20, 2022 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Aug 11, 2022 Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability Zero-day
Aug 11, 2022 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Aug 4, 2022 Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

By year

Year	Exploited flaws added	Zero-days
2026 (so far)	5	0
2025	4	0
2024	1	1
2023	2	1
2022	7	1

Questions

Is Zimbra safe right now?

No new exploited flaws in the last 30 days, but 1 in the last 90. Make sure those updates are installed. Confirm with the vendor's own advisories and install updates as soon as they're available.

How many Zimbra vulnerabilities have been exploited?

19 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 6 of them used by ransomware.

Covers products matching zimbra. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.