Zimbra 10.1.20: Patch the Pre-Auth SNMP RCE Hiding in Your Mail Server

On July 20, 2026, Zimbra released Collaboration Suite (ZCS) version 10.1.20 to address nine security vulnerabilities — one of which is critical: a pre-authentication command injection flaw in the SNMP monitoring subsystem that allows an unauthenticated attacker to execute arbitrary OS-level commands on your mail server. If you run Zimbra for business email, this patch goes to the top of the queue today.

The Critical Flaw: SNMP Command Injection

The most serious issue affects Zimbra's SNMP monitoring component. When two conditions hold simultaneously — SNMP notifications enabled and the integrated Swatchdog log-monitoring service running — an unauthenticated remote attacker can send crafted payloads that trigger arbitrary OS command execution on the server.

This deserves attention because SNMP tends to be treated as infrastructure plumbing. Administrators enable it for monitoring tools like Nagios, Zabbix, or PRTG, Swatchdog comes along for the ride, and neither gets revisited. The combination quietly creates an attack surface that most operators don't have on their mental model of that server's exposure. Zimbra hasn't published a CVE identifier for this flaw yet — standard practice during the patch window — which means the only reliable protection is updating to 10.1.20 now rather than waiting to evaluate a published proof-of-concept.

Four XSS Vulnerabilities in the Classic Web Client

Four separate cross-site scripting flaws were also fixed, all in the Classic Web Client interface:

• Stored XSS triggered by malicious attachment filenames under certain rendering conditions
• Two reflected XSS paths where crafted field inputs execute scripts when displayed
• An additional XSS vector through crafted attachment content during rendering

XSS in an email client is meaningfully worse than XSS on a typical web app. Script execution happens inside an authenticated browser session, giving attackers the ability to read messages, exfiltrate contacts, steal session tokens, or pivot to anything the victim user can access. Spear-phishing campaigns use exactly this kind of vector: send a crafted message, wait for the target to open it, harvest the session. Worth noting: 10.1.19 — the prior release — patched a critical stored XSS in the same Classic Web Client found by Google's Threat Analysis Group. Back-to-back critical XSS fixes in the same interface suggests it is receiving active research scrutiny right now.

Authorization Bypasses and SSRF

The remaining vulnerabilities are lower severity individually, but each one represents a meaningful gap:

• CVE-2026-50055 — A mail forwarding restriction bypass discovered by Rapid7 researcher Jonah Burgess. Zimbra lets administrators block users from forwarding mail outside the organization — a standard compliance control. This CVE lets an authenticated user silently route email externally anyway.
• CVE-2026-10631 — An access control flaw in the EWS extension (the compatibility layer for Outlook clients), allowing privilege overreach by authenticated users.
• CVE-2026-50054 — An authorization issue in mailbox delegation that could let a delegated user exceed their granted scope.
• An SSRF flaw in the Nextcloud integration, enabling server-side requests to internal resources — a common technique for probing internal networks or cloud metadata endpoints.

No confirmed active exploitation has been reported for any of these issues at the time of writing. That window won't stay open once researchers start working through the patch diffs.

What to Do

• Update to ZCS 10.1.20 immediately on any self-hosted Zimbra environment running a prior version.
• Audit your SNMP configuration. If SNMP monitoring is not actively used, disable SNMP notifications and the Swatchdog service now. If it is used, apply the patch first — then confirm that UDP port 161 is not publicly reachable.
• Check for unauthorized forwarding rules. CVE-2026-50055 may have been exploited before patching. Audit all external forwarding rules on high-value mailboxes (executives, finance, HR) and confirm nothing unexpected is in place.
• Review delegation grants on sensitive accounts for the same reason.
• Consider the Modern Web Client. The Classic Web Client is where all four XSS flaws live; the Modern client is unaffected. If switching is operationally viable, it reduces exposure while you schedule the patch.

Zimbra has logged a tough security stretch: multiple critical vulnerabilities since 2024, a zero-day harvested by state-sponsored actors in 2023, and now two consecutive releases addressing critical XSS in the same client interface. Mail servers sit at the intersection of authentication, communication, and elevated internal trust — which is exactly why they attract this level of attention. At Falcon Internet, mail infrastructure goes through the same patch cadence and 24x7x365 NOC monitoring as production web servers. Quiet infrastructure rarely stays quiet when it's been left behind on patches.