Summary 

• A regression in ZCS 10.1.15 causes zmpurgeoldmbox to delete external blobs (Scality, S3, OpenIO) after mailbox migration, even when zimbraMailboxMoveSkipBlobs=TRUE. 
• This results in permanent, irrecoverable email data loss on the destination server. 
• A fix is targeted for the 10.1.17 patch release. 
• Until then, do not run zmpurgeoldmbox after mailbox migrations if you use external or unified object storage. 

What Happened 

In ZCS 9.0, running zmpurgeoldmbox after a zmmboxmove correctly cleaned up only local metadata (MySQL + Lucene indexes) on the source server, leaving external blobs untouched. In ZCS 10.1.15, a code change inadvertently altered the logic that identifies external/centralized storage. As a result: 

• zmpurgeoldmbox now deletes external blobs even without the –forceDeleteBlobs flag 
• The destination server’s mailbox still references those deleted blobs 
• Affected users see “missing blob” errors and lose access to their emails permanently 

Am I Affected? 

You are affected if all of the following are true: 

1. You are running ZCS 10.1.15 or 10.1.16  
2. You use external object storage (Scality, S3, OpenIO, or similar) as a primary or secondary (HSM) volume — especially with unified storage enabled 
3. You perform mailbox migrations using zmmboxmove with blob-skipping attributes (zimbraMailboxMoveSkipBlobs=TRUE or zimbraMailboxMoveSkipHsmBlobs=TRUE) 
4. You run zmpurgeoldmbox on the source server after migration 

If you use only local (internal) storage and no external object storage, this issue does not affect you. 

Behavior Comparison: ZCS 9.0 vs 10.1.15 

* In ZCS 9.0, –forceDeleteBlobs was not implemented for external stores (Bug 96149). It is being properly implemented as part of the fix. 

Immediate Workaround 

• Do not run zmpurgeoldmbox (or PurgeMovedMailboxRequest via SOAP) after mailbox migrations if your environment uses external object storage. 
• Disable any automation or scripts that trigger zmpurgeoldmbox as part of post-migration cleanup. 
• Skipping the purge leaves residual local metadata (MySQL + Lucene) on the source server. This is harmless and can be cleaned up after the patch is applied. 
• zmmboxmove itself is not affected — mailbox migrations continue to work correctly. Only the post-migration purge step is problematic. 

The Fix 

The corrected behavior in 10.1.17 will be: 

• External blobs will only be deleted with an explicit –forceDeleteBlobs flag. 
• Targeted release: ZCS 10.1.17 patch.
• If you need an early-access build, contact Zimbra Support. 

What To Do Next 

1. Immediately stop running zmpurgeoldmbox after mailbox migrations in any environment with external storage. Disable related automation.
2. Audit recent migrations: if zmpurgeoldmbox was already run, verify blob integrity on the destination server using: 

zmprov gmi user@example.com 

zmblobchk -m <mailboxId> -v –output-used-blobs start 

If the output shows “blob not found” errors for external locators (containing @@), those blobs have been deleted. 

1. If data loss has occurred, check if your object storage provider supports versioning or soft-delete, there may be a recovery path. 
2. Plan for the 10.1.17 patch: after upgrading, you can safely resume zmpurgeoldmbox and clean up residual metadata from the workaround period. 

Questions? 

If you have questions, please contact Zimbra Support. 

Affected versions: ZCS 10.1.15 through 10.1.16 (all editions) 

Fix version: ZCS 10.1.17 (targeted) 

Tracking reference: ZBUG-5265 

Severity: Critical — potential data loss 

The post Product Advisory: zmpurgeoldmbox May Delete External Storage Blobs After Mailbox Migration appeared first on Zimbra : Blog.

In addition, this patch addresses multiple security vulnerabilities and Modern Web App improvements designed to streamline your email management and collaboration.

Patch Security Severity: High

Deployment Risk: High

• Zimbra 10.1.16 (Release Notes)

We strongly recommend all admins and users to upgrade to Zimbra 10.1.16 for improved stability and enhanced email compatibility.

Ubuntu 24 Support (Beta) is now available with this release.

Beta Notice: Beta features are unsupported and intended for lab/testing environments only. Do not deploy on production systems.

Additional Improvements and Fixed Issues

Additional Fixed Issues

• 20+ bug fixes across Modern Web App, Classic Web App, ActiveSync, EWS, Chat, and Zimbra Desktop improving stability and user experience.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.16 appeared first on Zimbra : Blog.

Deployment Risk: Low

We have released Zimbra Version 10.1.15, improving email rendering compatibility while maintaining critical security protections.

• Zimbra 10.1.15 (Release Notes)

We strongly recommend all admins and users to upgrade to Zimbra 10.1.15 for improved stability and enhanced email compatibility.

End of Life Notice: 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.15 appeared first on Zimbra : Blog.

We have released Zimbra Version 10.1.14 to address a critical issue in Version 10.1.13 that impacts IMAP synchronization across multi-server Zimbra environments, causing incorrect message display and synchronization failures.

For complete details and implementation guidance, please refer to our release notes:

• Zimbra 10.1.14 (Release Notes)

Customers on Version 10.1.13

Patch Security Severity: Low

Deployment Risk: Low

We strongly encourage all customers with a high IMAP user base who have upgraded to Version 10.1.13 to upgrade to Zimbra 10.1.14 immediately. Customers on Version 10.1.13 with a low IMAP usage pattern may continue using the current version and wait for the upcoming Version 10.1.15.

Customers on Version 10.1.12 or earlier

Patch Security Severity: High

Deployment Risk: Low

Customers currently on Patch Version 10.1.12 or earlier are recommended to upgrade directly to Version 10.1.14 for improved stability and fixes.

This new patch version also resolved slowdown issues when switching to the Zimbra user post-upgrade to Version 10.1.13. User switching is now significantly faster and more responsive through optimized license data caching.

End of Life Notice: Zimbra 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Emergency Patch Release: Zimbra 10.1.14 appeared first on Zimbra : Blog.

Deployment Risk: Medium

This patch fixes a stored cross-site scripting (XSS) vulnerability and enhances protection by upgrading AntiSamy to version 1.7.8 and removing the outdated code. It includes critical fixes and user experience improvements for the following editions:

• Zimbra 10.1.13 (Release Notes)
• Zimbra 10.0.18 (Release Notes)

We recommend all administrators and users to apply this update to strengthen your system’s stability and ensures uninterrupted service performance.

Communication & Collaboration

• Ignite: Smart email search with instant suggestions and LDAP-supported external email warning
• Modern Web App: Improved drag-and-drop, calendar management, tag organization, dumpster functionality, and POP/IMAP settings in Modern UI
• Zimbra Connector for Outlook (ZCO): Outlook 2024 compatibility, better meeting proposals and shared folder handling
• ActiveSync & Exchange Web Services (EWS): Reliable iOS attachments and consistent calendar sync across all devices. Following Microsoft’s recent announcement extending Legacy EWS support to October 2026 (from the previous October 2025 deadline), Zimbra will maintain EWS compatibility across all currently supported Outlook versions, ensuring uninterrupted service for Outlook clients using this protocol.
• Chat and Video: Chat zimlets and extensions have been updated with the latest improvements. Chat installer zfzi-2.0.1 is now available, and the customization version has been updated to 10.2.1, bringing enhanced performance and bug fixes.

Modern UI Enhancements

• POP/IMAP Management: Users can now manage email access settings directly from Modern Webmail, including on mobile.
• Copy-Paste Formatting: Content from Excel, PowerPoint, Word, and web pages now keeps its formatting when pasted into emails.
• Meeting Control: Meeting organizers can now customize cancellation messages and choose to cancel single meetings or entire series. Users now have ‘Edit Message’ option to personalize their messages before responding.
• Enhanced Recovery: Restore deleted emails, contacts, appointments, and files directly from Trash.
• Quick Distribution List View: See all members of a distribution list instantly from the message preview without having to switch views.
• Improved Tags: Tags now work consistently across all features with bug fixes.
• Drag-and-Drop Uploads: Easily drag files into Briefcase, just like in Classic UI.
• One-Click Recipient Removal: Remove any recipient (To, Cc, Bcc, or invitee) by clicking the “X” next to their name across Mail, Calendar, Briefcase, and Contacts.
• Redesigned Tag Management: Cleaner interface makes creating and organizing tags easier with better visuals and accessibility.
• Visual Drop Indicators: Clear highlighting shows exactly where items will land when dragging and dropping across Mail, Briefcase, and Contacts.

Security Updates

• Enhanced S3 data management and cleanup for mailbox moves
• Strengthened TLS handling per updated RFC standards

Performance Optimizations

• Faster email thread loading with Smart Conversation Loading
• Improved performance for large folders sets in Mail and Briefcase
• Optimized Briefcase memory management

End of Life Notice: 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.13, 10.0.18 appeared first on Zimbra : Blog.

Patch Security Severity: High

Deployment Risk: Low

This patch fixes a critical security vulnerability related to a Server-Side Request Forgery (SSFR) in the chat proxy configuration. 

We recommend all users and administrators, especially those on Zimbra versions 10.1.5 to 10.1.11 to apply this update immediately. It will strengthen your system’s stability and ensures uninterrupted service performance:

• Zimbra 10.1.12 (Release Notes)

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Emergency Patch Release: Zimbra 10.1.12 appeared first on Zimbra : Blog.

Deployment Risk: Low

This patch updated on August 8th, 2025 includes hotfix for the following editions:

• Zimbra 10.1.11 (Release Notes)
• Zimbra 10.0.17 (Release Notes)

Hotfix for 10.1.11 & 10.0.17

ActiveSync: Resolves an issue that was affecting the iOS Mail app, ensuring improved functionality for all users. We recommend applying this hotfix for a seamless experience.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.11, 10.0.17 appeared first on Zimbra : Blog.

Deployment Risk: Low

This patch updated on July 18th, 2025 focuses on essential fixes and user experience improvements for the following editions:

• Zimbra 10.1.10 (Release Notes)
• Zimbra Daffodil 10.0.16 (Release Notes)

End of Life (EOL) Notice

Zimbra Daffodil 10.0: Zimbra Daffodil 10.0 reached the end of General Support on June 30th, 2025, and is set to reach EOL on December 31st, 2025.  No further updates will be provided after this date. Customers using these versions are advised to plan their migration to the 10.1 version to ensure continued security updates and access to the latest features.

Zimbra 9.0: Zimbra 9.0 reached EOL on June 30th, 2025.

We strongly recommend upgrading to a supported version like Zimbra 10.1 to maintain security, performance, and access to our dedicated support. We’re here to help make this transition as smooth as possible: 

• Migration Guides: Access comprehensive resources to guide your upgrade.
• Personalized Assistance: Need a hand? Our team is ready to assist you.

CentOS 7, RHEL 7, and Oracle Linux 7

RHEL7 and CentOS 7 reached EOL in June 2024, and Oracle Linux 7 in December 2024.

Zimbra will deprecate support for these operating systems following the release of Zimbra 10.1.10 by July 2025.  After this release, no further updates, patches, or official support will be provided for RHEL/CentOS/Oracle 7 operating systems.

We recommend upgrading to RHEL/Rocky/Oracle Linux 9. For assistance, please contact our Support team.

Things to know before you upgrade

Changes to SpamAssassin

Apache SpamAssassin has been upgraded to version 4.0.1 to fix multiple bugs.  If you have made custom changes to this file, please back up your current file before the upgrade and after the upgrade, re-apply your changes manually to the new salocal.cf.in.  Please refer to the Release Notes for more details.

What’s New in 10.1.10

User Interface (UI) & Usability:

Password expiry reminder

This feature allows system administrators to enable password expiry reminders for users so that they are informed about the upcoming password expiration of their account and accordingly can take the required action.

Modern UI Enhancements

Display a tag icon in the message list

Tagged emails and conversations threads will now display a tag icon directly in the message list, positioned near the attachment icon.

Improved Dark Mode

Previously, mail contents was not visible as expected in dark mode. Modern UI dark theme has been improved to ensure mail contents are displayed correctly.

Smart Scroll Handling

The chat interface now auto-scrolls to new messages, even in active conversations.

Preview markdown files in Modern UI

This feature supports previewing attached Markdown (.md) files directly within the Modern UI. Users can view Markdown content seamlessly in side panel, files stored in Briefcase and included in calendar invites.

Security

Block attachment downloads

Modern UI The “zimbraAttachmentsBlocked” attribute now works as expected for the Modern UI. When it is set to true, it blocks attachment downloads for the emails with attachments.

Provide a new option to update the digital certificate for S/MIME

Users can now not only upload but also replace or remove the digital uploaded S/MIME certificate.

Communication & Collaboration

ZCO / ActiveSync / EWS

Multiple enhancements and fixes in calendaring, sharing, delegation, and mail syncing with Outlook and other Apps.

Chat

• Core Platform Enhancements: massive domain provisioning, internationalization for Classic UI, Zimbra Desktop integration, Chat data preservation
• Usability & Operational Improvements: General UX polish, Dark Mode improvements, Smart Scroll handling

Security Fix – 10.1.10 & 10.0.16

• GraphiQL IDE Disabled: For enhanced security, the accessible GraphiQL IDE has been disabled.
• Dependency Updates: We’ve upgraded the @babel/runtime package to resolve a ReDoS vulnerability.
• Authentication & Password Security:
  • Addressed a CSRF vulnerability found on the Reset Password Endpoint.
  • Fixed an issue allowing Two-Factor Authentication bypass through unauthorized 2FA modification.
• Rsync Package Update: The rsync package has been updated to patch multiple vulnerabilities.

Refer to our Zimbra Security Center to ensure your system is safe.

Fixed Issues – 10.1.10

• Zimbra, Modern UI, Classic UI, and Admin Console
• Zimbra Connector for Outlook (ZCO)
• ActiveSync and EWS
• Backup&Restore Improvements & Migrations
• Chat
• Third party upgrade

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.10, 10.0.16 appeared first on Zimbra : Blog.

Deployment Risk: Low

This patch updated on June 18, 2025 focuses on essential security fixes for the following editions:

• Zimbra Daffodil 10.1.9 (Release Notes)
• Zimbra Daffodil 10.0.15 (Release Notes)
• 9.0.0 P46 (Release Notes)

Security Fix – 10.1.9, 10.1.15, 9.0.0 P46

• Addressed a XSS attack with ICS file in Classic UI
• Addressed a denial of service (DoS) vulnerability on Admin Console

Please note that this is the final patch release for: 

• Zimbra Collaboration 9.0.0 P46 before its End of Life (EOL) on June 30, 2025
• Zimbra Daffodil v. 10.0.x set to reach End of General Support on June 30, 2025 

After this date, no further updates will be provided to the 10.0.x and 9.0 editions.

We’re Here to Support Your Migration 

We strongly recommend upgrading to a supported version like Zimbra Daffodil 10.1 to maintain security, performance, and access to our dedicated support. We’re here to help make this transition as smooth as possible: 

• Migration Guides: Access comprehensive resources to guide your upgrade. 

• Personalized Assistance: Need a hand? Our team is ready to assist you. 

To ensure you benefit from the most secure and advanced solutions, please note the upcoming product lifecycle updates for the following Zimbra editions: 

Upgrade Documents

Non-NG setup

In-Place Upgrade Guide (Single and Multi-Node setup)

Rolling-Upgrade Guide (Multi-Node setup)

NG setup – For 9.0.0, 8.8.15 (Network and FOSS)

In-Place Upgrade Multi-Node | In-Place Upgrade Single-Node

Rolling Upgrade Multi-Node | Rolling Upgrade Single-Node

For assistance during this transition, contact Zimbra Support.

Zimbra Daffodil 10.1 is the active and supported version.

CentOS/RHEL 7 OS and Oracle Linux 7

It is equally important to install operating system security updates and have Zimbra run on supported operating systems.  After July 1, 2025, RHEL/CentOS 7 and Oracle Linux 7 will no longer be supported for Zimbra.

We recommend upgrading to RHEL/Rocky/Oracle Linux 9.  If you have questions or need guidance with upgrading your operating system, please open a support case through the Zimbra Support.

We continuously offer our Buy One, Get One promotion on Zimbra Advanced Chat.

Key Offer Details:

• Minimum purchase: 25 users
• Validity: Offer is valid till 31 December, 2025
• Eligibility: New purchases only
• Version Compatibility: Available for Zimbra version 10.1.7 or greater
• License Type: No mix-and-match of subscription and perpetual terms
• Renewals: After the promotion period, renewals will be at the regular price

#ICYMI (In-Case-You-Missed-It)

New License Key Required for Zimbra Daffodil 10.1

It is mandatory to obtain a new license key to run the Zimbra Daffodil 10.1 software. 
You will not be able to proceed without a new Zimbra Daffodil V10.1 license key (including trial license). Watch the video or read the blog to find out more.

YouTube link to License Management Video

---

Refer to the release notes for the patch installation on Red Hat and Ubuntu platforms.

An upgrade to the latest patch for your version is highly recommended. Refer to our blog and the Zimbra Security Center for steps to ensure your system is safe.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Emergency Patch Release: Zimbra Daffodil 10.1.9, 10.0.15 and Zimbra 9.0.0 P46 appeared first on Zimbra : Blog.

Deployment Risk: Low

This release focuses on essential fixes and user experience improvements for the following edition

• Zimbra Daffodil 10.1.8 (Release Notes)
• Zimbra Daffodil 10.0.14 (Release Note)
• 9.0.0 P45 (Release Notes)

End of Life (EOL) Notice

ZCS 9.0 & 10.0

Zimbra Collaboration 9.0 is set to reach its End of Life on June 30th, 2025, and Zimbra Daffodil v. 10.0.x is set to reach End of General Support on June 30th, 2025.  No further updates will be provided after this date. Customers using these versions are advised to plan their migration to the 10.1 version to ensure continued security updates and access to the latest features.

Upgrade Documents

Non-NG setup

In-Place Upgrade Guide (Single and Multi-Node setup)

Rolling-Upgrade Guide (Multi-Node setup)

NG setup – For 9.0.0, 8.8.15 (Network and FOSS)

In-Place Upgrade Multi-Node | In-Place Upgrade Single-Node

Rolling Upgrade Multi-Node | Rolling Upgrade Single-Node

For assistance during this transition, contact Zimbra Support.

Zimbra Daffodil 10.1 is the active and supported version.

CentOS/RHEL 7 OS

RHEL/CentOS 7 and Oracle 7 will no longer be supported after Zimbra 10.1.9’s release on July 1, 2025. We recommend upgrading to RHEL/Rocky/Oracle Linux 9. For assistance, please contact our Zimbra Support.

If you have questions or need guidance with upgrading your operating system, please open a support case through the Zimbra Support.

Patch updated on May 15^th, 2025 includes the following for this release

Check out the Release Note – Things to know before you upgrade sections for this version of Zimbra Collaboration.

Security Fix – 10.1.8, 10.1.0, 9.0.0 P45

• Addressed a denial of service (DoS) vulnerability that could lead to service disruptions.

What’s New – 10.1.8

New Zimbra Chat in Classic UI

Zimbra Chat has been introduced since 10.1.7, and this new feature is available not only in Modern UI but also Classic Web Client (Classic UI).  This chat feature is offered in two distinct variants: Basic Chat and Advanced Chat.  Both variants are now integrated directly into both UI and support secure on-premises deployment.

Delivery Status Notification (DSN)

This feature allows users to receive success or failure notifications for sent emails.  This allows users to identify and correct issues like incorrect email addresses, server issues, or other delivery problems.  DSNs also help with email marketing campaign management, as they provide insights into email delivery performance and identify potential problems. Admins can enable or disable DSN at the COS or Account level.

Undo in plain text mode in Modern UI

The Undo (Ctrl+Z) functionality is now available when composing emails in plain text mode in the Modern UI, allowing users to easily revert recent changes while writing.

Exclusive Offer: Double your Advanced Chat! Don’t miss our Buy One, Get One promotion on Zimbra Advanced Chat.

Key Offer Details:

• Minimum purchase: 25 users
• Validity: Offer is valid till 31 December, 2025
• Eligibility: New purchases only
• Version Compatibility: Available for Zimbra version 10.1.7 or greater
• License Type: No mix-and-match of subscription and perpetual terms
• Renewals: After the promotion period, renewals will be at the regular price

#ICYMI (In-Case-You-Missed-It)

New License Key Required for Zimbra Daffodil 10.1

It is mandatory to obtain a new license key to run the Zimbra Daffodil 10.1 software. 
You will not be able to proceed without a new Zimbra Daffodil V10.1 license key (including trial license). Watch the video or read the blog to find out more.

YouTube link to License Management Video

Refer to the release notes for the patch installation on Red Hat and Ubuntu platforms.

An upgrade to the latest patch for your version is highly recommended. Refer to our blog and the Zimbra Security Center for steps to ensure your system is safe.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra Daffodil 10.1.8, 10.0.14 and Zimbra 9.0.0 P45 appeared first on Zimbra : Blog.