# Zimbra's Patch Dump Includes an Unauthenticated RCE — and a Policy Bypass That Quietly Breaks Your Security Controls
If you run Zimbra Collaboration Suite and you haven't pushed version 10.1.20 yet, stop reading and go do that. Come back when it's done.
Still here? Let's talk about why this patch batch is worse than most Zimbra updates, and what the forwarding restriction bypass in particular says about a category of vulnerability that doesn't get enough attention.
## The Worst Bug in the Pile
The headline item is a command injection flaw in Zimbra's SNMP monitoring component. Under two conditions — SNMP notifications are enabled and the integrated Swatchdog service is running — an unauthenticated attacker can send crafted payloads to the server and execute arbitrary OS commands in the background.
That's remote code execution without credentials. On an email server.
The conditions aren't as limiting as they sound. Zimbra deployments in larger environments and government networks routinely use SNMP for monitoring. And Swatchdog, which handles log-watching and alerting, is often enabled alongside it. This isn't an edge configuration — it's a fairly standard enterprise setup.
The disclosure timeline adds a wrinkle: this command injection was publicly reported in late June. That means it sat in the open for roughly three weeks before a permanent fix shipped. Zimbra says it sees no evidence of in-the-wild exploitation, but "no evidence" after three weeks of a known, unauthenticated RCE on email infrastructure is the kind of statement that deserves scrutiny. Attackers who find something like this don't always announce themselves.
## Four XSS Bugs in the Same Client — Again
The update also addresses four cross-site scripting flaws in the Classic Web Client. These can be triggered through malicious attachment filenames, crafted fields, and crafted attachments.
Here's the pattern worth naming: just two weeks ago, Zimbra patched a *different* critical XSS bug in the same Classic Web Client — one that could lead to code execution when a victim simply opened a specially crafted email. Now there are four more.
The Classic UI is old. It's carried legacy code through years of refactors, and XSS issues in web-based email clients are extraordinarily dangerous because the attack surface is the inbox itself. You don't need to trick a user into clicking a suspicious link. The malicious payload arrives as an email, and the act of opening it is enough.
If your organization is still running the Classic Web Client because migrating users is inconvenient, this patch cadence should change that calculation.
## The Policy Bypass That Actually Worries Me Most
CVE-2026-50055 is a mail forwarding restriction bypass, and it's the bug I keep coming back to.
Zimbra gives administrators the ability to restrict mail forwarding — a common control in regulated industries where data exfiltration via auto-forward is a real threat. Attackers and malicious insiders who compromise an account can set up silent forwarding rules that siphon every incoming email to an external address. Disabling forwarding at the admin level is supposed to close that door.
CVE-2026-50055 means the door wasn't closed. An authenticated attacker — someone who's already compromised credentials — could exfiltrate email even with forwarding restrictions in place.
This matters because organizations in healthcare, finance, law, and government often implement forwarding restrictions precisely because they've assessed the risk and decided it's too high. They've documented the control. They may have checked a compliance box. And for some period of time, that control was illusory.
The fix is in 10.1.20. The question worth asking is how long this vulnerability existed before it was caught.
## The Rest of the Package
Rounding out the update:
Zimbra has provided minimal technical detail on most of these, which is their standard approach. It's a reasonable call for minimizing script-kiddie exploitation of newly disclosed bugs, but it makes independent risk assessment harder.
## HackWire Analysis
Zimbra's persistent vulnerability problem deserves to be named for what it is: a long-running pattern that nation-state actors have already monetized.
In 2023, CISA, NSA, and multiple international agencies issued joint advisories warning that APT groups — including actors tied to China, Russia, and Iran — were actively exploiting Zimbra vulnerabilities to compromise government and critical infrastructure email servers globally. The attacks weren't opportunistic. They were targeted, and they worked because Zimbra deployments often lag on patching. The software is widely used in government networks in Europe, Asia, and Latin America, where IT staffing and patch cadence can be inconsistent.
The command injection disclosed in late June is exactly the kind of bug that draws attention from persistent threat actors who monitor vulnerability databases for targets. Three weeks is a long window. If this appears in exploitation telemetry over the next month, nobody should be surprised.
The forwarding restriction bypass is the sleeper risk here. Defenders tend to focus on the most dramatic-sounding vulnerability — RCE, unauthenticated access — but policy bypasses cause a different kind of damage. They don't just give attackers access; they make security teams think they had a control in place when they didn't. In regulated environments, that's both a breach risk and a compliance problem. Organizations that relied on Zimbra's forwarding restrictions as a documented control should conduct a review of whether exfiltration activity occurred during the window the vulnerability was present.
Patch to 10.1.20. Audit Classic Web Client usage and prioritize migration where feasible. Review SNMP configurations and consider whether Swatchdog exposure is necessary. And treat CVE-2026-50055 as a signal to re-verify all your forwarding restriction controls — not just in Zimbra, but across your email stack.
— HackWire Editorial
## Related Coverage