InfoSecBulletin Cybersecurity for mankind
Rapid7 researchers found 17 security flaws in Zimbra Collaboration Suite (ZCS) that mess up authentication, mailbox isolation, and host privileges. These issues let attackers take over user sessions through cross-site scripting, read any mailbox, and gain root access. Admins need to install the latest Zimbra patch updates right away and check server settings.
Vulnerability details:
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
Total: 17 CVEs
Severity: 7 High · 10 Medium
Actively exploited: None confirmed
Highest severity: 8.7 (High · CVSSv3) — CVE-2026-10632
Action: Apply the latest security updates now
An attacker can use a weak account to take advantage of these flaws and access other people’s mailboxes or important system files, according to the Rapid7 report. There is no public code showing how this is done, and there are no known attacks happening right now.
Affected Versions
These Zimbra Collaboration Suite problems affect ZCS 10.1 versions up to 10.1.21. CVE-2026-10632 impacts version 10.1.16. CVE-2026-93638 and CVE-2026-50053 affect versions up to 10.1.17. Issues like CVE-2026-93631, CVE-2026-93633, CVE-2026-93634, CVE-2026-93639, CVE-2026-115785, and CVE-2026-115786 affect versions up to 10.1.20. Also, the local privilege escalation, calendar, and LDAP issues impact versions through 10.1.21.
Patch and Mitigation Steps
Zimbra has released fixes for versions 10.1.17, 10.1.18, 10.1.20, and later security updates found on the official Zimbra Security Advisories page. Administrators need to upgrade their ZCS installations to the latest patch right away. Also, security teams should check sudoers policies on MTA and mailbox nodes, look at linked OAuth data sources, and watch for unauthorized mailbox access.
