Zimbra 10.1.20 patches critical command injection plus three CVEs

Zimbra released Daffodil 10.1.20 — a patch update following the earlier 10.1.19 XSS fix two weeks ago — closing a critical command injection in the SNMP monitoring component, four stored XSS flaws in the Classic UI, an SSRF in the Nextcloud integration, and three assigned CVEs affecting mail forwarding, EWS extension access, and mailbox delegation. Zimbra has not shipped CVSS scores with the release and has published no detail on any of the individual flaws, per SecurityWeek's coverage, but urges every operator to upgrade "as soon as possible."

What's in the release

Per Zimbra's patch release notes:

• Command injection in the SNMP monitoring component — rated critical, no CVE assigned.
• Four stored cross-site scripting vulnerabilities in the Classic Web Client, the same UI patched in 10.1.19.
• Server-side request forgery in the Nextcloud integration.
• CVE-2026-50055 — mail forwarding restriction bypass.
• CVE-2026-10631 — access control issue in the EWS extension (Exchange Web Services compatibility).
• CVE-2026-50054 — mailbox delegation authorization flaw.

Affected releases

Zimbra names only the fixed release — ZCS 10.1.20 — in the patch notes and has not published a per-CVE version-affected list. Any Zimbra Collaboration Suite deployment on the 10.1 branch prior to 10.1.20 is presumed exposed to at least one of the flaws.

Exploitation status

No exploitation observed. SecurityWeek's summary is explicit: "Zimbra has refrained from sharing further details on these security defects, but urges users to update to ZCS 10.1.20 as soon as possible. However, it makes no mention of any of these issues being exploited in the wild." No public PoC has been posted for any of the CVEs at time of writing, and none appear on the CISA KEV catalogue.

The 10.1.19 stored XSS two weeks ago was reported by Google's Threat Analysis Group — the team that surfaces state-actor zero-days. Zimbra has not disclosed the reporter for any 10.1.20 flaw. Given the pattern — TAG reporting XSS in the same UI that shipped four more XSS bugs in the next patch — treat the Classic Web Client as under active review by advanced operators.

Action checklist

1. Upgrade to ZCS 10.1.20 today. The critical-rated SNMP command injection is unauthenticated-adjacent in most deployments (SNMP monitor endpoints tend to sit inside management VLANs but are frequently reachable from broader operations networks). No signature or virtual patch replaces the upgrade.
2. If you cannot upgrade immediately, firewall the SNMP monitor endpoint. Restrict access to the specific management hosts that actually poll it. This is a mitigation, not a fix.
3. Retire the Classic UI where you can. Two consecutive Zimbra patches — 10.1.19 and 10.1.20 — have shipped stored-XSS fixes in the same webmail. If your users can move to the Modern UI, do it. If they cannot, treat every Classic UI session as high-risk until the reporter identities and CVE detail are published.
4. Watch for the vendor-follow-up disclosure. Zimbra's pattern is a short patch note today, a fuller advisory later. The CVE detail — CVSS vectors, technical writeup, affected version ranges — will land in NVD in the following weeks. Track NVD CVE-2026-50055, 10631, and 50054 for the enrichment.
5. Audit mail forwarding rules on every mailbox. CVE-2026-50055 is a forwarding-restriction bypass — the class of bug an attacker uses to persist mailbox-level access after credential rotation. A post-upgrade sweep for unexpected external forwarding rules is the least you should run.

Context

Zimbra shipped eight Daffodil patch releases in 2026 before 10.1.20. Four of them — 10.1.13, 10.1.17, 10.1.19, and now 10.1.20 — have closed cross-site scripting in the Classic Web Client, and three of those four were rated high or critical. The Classic UI is the deprecation Zimbra has not managed to close: legacy customers hold onto it because Modern UI keyboard shortcuts and profile behaviour differ from Outlook Web Access habits, and the reporter volume against Classic UI attests to how much attacker attention the remaining surface draws.

The SNMP command injection is the more urgent single flaw in this release. Zimbra's SNMP monitor is opt-in but frequently enabled on multi-tenant hosting deployments where per-mailbox monitoring is a contractual requirement — and the endpoint tends to sit outside the same reverse-proxy hardening operators apply to mail and calendar traffic. The lack of CVSS or CVE ID for it is Zimbra's usual disclosure cadence, not a signal of low severity.