Zimbra Collaboration Suite v10.1.21 (Daffodil), available September 24, 2026, brings meaningful workspace innovations that make enterprise collaboration faster, smarter, and more personal. It also closes active security vulnerabilities that no production environment should carry unpatched. And with over 50 platform fixes, it ensures the infrastructure underneath performs as reliably as the teams depending on it.

Here is everything included in this release.

Three Features That Change How Teams Work

1. Mail Recall – Because Mistakes Happen

Enterprise teams send thousands of emails every day. The moment a mis-sent draft or wrong-recipient message leaves an outbox, the clock starts ticking. Until now, there was no clean way to stop it. 

Zimbra 10.1.21 introduces native Mail Recall in both the Modern Web App and Zimbra Desktop. 

Sent internal messages can now be recalled within a configurable time window. The message is removed cleanly from the recipient’s inbox, and an automatic status notification confirms the recall is complete — giving users peace of mind and immediate control over accidental mis-sends. 

It is a focused workflow improvement with an outsized impact on how confidently and safely teams communicate every day. 

2. Revamped Language Module — Enterprise Collaboration Without Borders

Great software is only as effective as the language it speaks. For global teams, an interface that feels imprecise or awkward in their primary language introduces subtle friction every single workday. 

In Zimbra 10.1.21, our engineering team conducted a comprehensive, proactive review of the entire Modern Web App localization framework — updating over 6,000 UI translation phrases across the interface and addressing more than 50 direct customer-reported translation requests. As a result, everything on your screen feels authentically local, not merely translated. 

Beyond accuracy, Zimbra 10.1.21 also adds native language support for Bahasa Indonesia and Filipino (Tagalog), extending the platform’s reach to enterprise teams across Southeast Asia who can now work in their primary language from day one — and experience Zimbra the way it was always meant to feel. 

3. Per-Domain IdP & SAML Routing — Identity Management at Scale 

Organizations running multiple business units, customer brands, or managed tenants on a shared Zimbra environment have historically faced friction around authentication. A single shared Identity Provider meant shared configuration risk and the constant threat of cross-domain SSO conflicts. 

Zimbra 10.1.21 solves this cleanly. 

Administrators can now assign a distinct Identity Provider to each domain. Users are automatically routed to their domain’s designated IdP at login, with fully isolated authentication metadata per domain — no configuration collisions, no cross-tenant leakage. 

And for the first time, none of this requires editing configuration files at the command line. A new point-and-click SAML Setup Wizard in the Admin Console makes domain-level authentication accessible to any administrator. IdP metadata import, certificate management, and domain authentication configuration are handled entirely through a clean graphical interface — no server access required. 

For MSPs and hosting partners managing multiple client tenants, this is a significant operational unlock that removes a longstanding complexity barrier. 

More in This Release: Everyday Enhancements That Add Up

Alongside the three headline features, Zimbra 10.1.21 delivers a focused set of workflow improvements for users and administrators across the platform: 

Security Hardening: High-Priority Platform Defence 

Zimbra 10.1.21 includes essential security updates addressing account protection, remote authentication, web client safeguards, and core runtime components. Environments running unpatched versions carry unmitigated security risks, and administrators are strongly advised to apply this release immediately. 

To protect active deployments while giving IT teams clear visibility into risk areas, key fixes in this release address: 

• Account Recovery & Identity Workflows: Neutralizes security flaws within self-service password recovery logic that exposed user accounts to unauthorized access. 

• WebDAV Remote Access & MFA Enforcement: Corrects pre-MFA session validation logic, strictly requiring full multi-factor authentication completion before granting WebDAV endpoint access. 

• Classic Web Client Safeguards: Resolves stored cross-site scripting (XSS) vectors in the Classic Web Client to prevent malicious script execution via crafted email content. 

• Core Runtime & Infrastructure: Upgrades the underlying execution environment to OpenJDK 17.0.19 and refreshes web server cryptographic modules. 

Platform Stability: 50+ Fixes Across the Stack

Reliable daily operations depend on what happens beneath the surface. Zimbra 10.1.21 resolves over 50 targeted issues across connectors, server infrastructure, and webmail: 

• Zimbra Connector for Outlook (ZCO)
  Outlook no longer faces stability issues during two-factor device re-validation or when authentication attributes are empty. MIME boundary parsing has been corrected so complex email attachments always render in full. Domain password expiration now triggers an explicit credential prompt in Outlook rather than silent send/receive failure. Oversized attachment bundles are handled cleanly with a dedicated notification dialog that identifies the offending files.
• Server Operations and Storage
  An IMAP socket resource leak triggered by out-of-bounds fetch requests, including Apple Mail on iOS 18, has been resolved, preventing mailbox locking and preserving server memory. An automated daily background utility now clears accumulated temporary processing files at 1:00 AM server time, preventing disk space inflation over time. System-wide validation now blocks email forwarding rules that target a user’s own address or alias, eliminating accidental mail loop conditions. Large account deletions are handled more safely, with directory cleanup deferred until mailbox purges are fully complete.
• Webmail, Shared Folders, and Licensing
  Users can now move and delete messages within individually mounted shared folders. Deleting items from a shared folder correctly places a copy in the user’s own Trash, consistent with expected behavior across all clients. Cross-interface signature editing inconsistencies, saved search sorting, print preview freezing, folder hierarchy display in move dialogs, and external address book autocomplete have all been resolved. License accounting now correctly handles full inheritance chains for domain default configurations, and outbound license communications support HTTP/HTTPS proxy routing.

Four Reasons to Upgrade to 10.1.21 

1. A platform that keeps getting better 

From user control innovations like Mail Recall and Self-Service Storage Cleanup to Modern Web App refinements side-by-side calendar views, density modes, inline replies, a guided onboarding tour, and 6,000+ translation fixes with native Bahasa Indonesia and Tagalog support, every release makes daily email and collaboration smoother, more responsive, and more capable.

2. Enterprise identity, simplified 

Per-Domain IdP & SAML Routing gives each domain its own Identity Provider with isolated authentication metadata to eliminate cross-tenant SSO conflicts. The new Admin Console SAML Setup Wizard lets administrators handle domain SAML configuration, metadata imports, and certificates entirely through a point-and-click UI with no manual configuration files required.

3. Proactive Security hardening included 

Delivers urgent security patches for self-service account recovery, WebDAV MFA enforcement, Classic Web Client XSS safeguards and OpenJDK 17.0.19. Unpatched environments carry documented risk and should upgrade immediately.

4. Platform stability and operational confidence 

Over 50 targeted fixes across Outlook connectors (ZCO), IMAP server operations, shared folder workflows, and automated disk cleanup ensure the predictable, dependable performance enterprise operations require.

Upgrade to Zimbra 10.1.21 

Zimbra 10.1.21 is recommended as a High Priority upgrade given the security and stability improvements included in this release. Validating the update in a staging environment prior to production deployment is recommended. 

Read the Full Release Notes →
Patch Installation Guide →
Contact Zimbra Support →

The post What’s New in Zimbra 10.1.21 (Daffodil) appeared first on Zimbra : Blog.

That’s starting to change. In a recent piece for IT Europa, Zimbra CRO Anthony Chadd pointed to a real shift underway: procurement teams are asking harder questions about flexibility, data residency, and long-term control, not just cost and functionality. France’s move to reduce reliance on proprietary desktop software and Schleswig-Holstein’s push toward digital independence are two visible public-sector signals. Wire’s State of Digital Sovereignty 2025 report backs this up with numbers: 63.2% of respondents now consider open-source software critical to their sovereignty strategy, 47.4% see reducing dependency on US technology vendors as a strategic imperative, and 36.8% now treat EU data hosting as a real procurement factor. 

Why email is the flashpoint 

Email is usually the last thing anyone questions. It’s treated as a utility, not a decision. That’s exactly why it’s become such a clear test case for this shift. The questions procurement teams are now asking, where does our data actually sit, does our hosting align with sovereignty requirements we’re on the hook for, are we locked into one vendor’s ecosystem by default, didn’t used to come up in an email RFP. Now they do. 

For organizations in the EU, this isn’t an abstract compliance exercise. The US CLOUD Act allows US jurisdiction to reach data stored by US-headquartered providers regardless of where that data physically sits. That’s a real gap for any organization relying on Microsoft 365’s EU data-residency options as a sovereignty answer. Data residency and data sovereignty are not the same thing, and the difference matters most in exactly the systems, like email, that everyone assumed were settled. 

A live example, not a hypothetical 

SITIV, the French public IT services operator, is a case in point. Rather than defaulting to Microsoft, SITIV reassessed its messaging platform against sovereignty and governance requirements for a user base north of 30,000 across the public sector. The result: full control over data jurisdiction, resilience at scale, and lower licensing and maintenance costs as a byproduct, not the starting point. 

Where this leaves procurement teams 

Nobody’s arguing for a return to fragmented, best-of-breed chaos. What’s changing is the assumption that one integrated ecosystem should own every workload by default. The organizations getting this right are the ones preserving choice deliberately, on jurisdiction, on deployment model, on which vendor sits behind a system as foundational as email, rather than inheriting that choice from whichever platform won everything else. 

That’s the case for evaluating deployment flexibility, data sovereignty, and privacy as procurement criteria in their own right, not nice-to-haves bundled into a bigger platform decision. 

Source: Anthony Chadd, “Are customers more willing to challenge ‘Microsoft by default’ procurement?”, IT Europa, July 2026. 

The post When email becomes a sovereignty decision appeared first on Zimbra : Blog.

Deployment Risk: Low

We have released Zimbra Collaboration Suite (ZCS) v10.1.20.

This release contains fixes for multiple critical security issues including a permanent fix for the critical SNMP vulnerability disclosed in our recent security advisory. The release also includes bug fixes in licensing and mail filtering.

• Zimbra 10.1.20 (Release Notes)

We strongly recommend upgrading to this version to keep your environment secure.

Critical Security Fixes

The following issues are fixed in this release:

• A command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled. (Permanent fix for the vulnerability disclosed in our security advisory on 26th June 2026)
• A stored cross-site scripting (XSS) vulnerability in the Classic Web Client that could allow malicious attachment filenames to execute script under specific conditions.
• A XSS vulnerability in the Classic Web Client where crafted fields could execute malicious script under specific conditions.
• A XSS vulnerability in the Classic Web Client where a crafted field could execute malicious script when rendered.
• A XSS vulnerability in the Classic Web Client where crafted attachments could execute malicious script when rendered.
• A mail forwarding restriction bypass that could allow authenticated users to exfiltrate email despite mail forwarding restrictions being enabled.
• A security issue in the EWS extension related to access controls.
• An authorization issue in mailbox delegation.
• A server-side request forgery (SSRF) vulnerability in the Nextcloud integration.

Note: In line with industry best practices, information disclosure is limited for security vulnerability fixes. 

Other Bug Fixes

• Licensing: Corrected “Reset to COS Value” so feature usage counts restore correctly instead of resetting to zero.
• Mail Forwarding: Fixed admin mail redirects being blocked when user forwarding restrictions are switched on under very specific conditions.

If you require assistance applying the new patch or have concerns regarding potential exposure, please raise a support ticket here.

The post Patch Release Update: Zimbra 10.1.20 appeared first on Zimbra : Blog.

Deployment Risk: Low

We have released Zimbra 10.1.19 to address a critical security vulnerability which impacts the Classic Web Client:

• Zimbra 10.1.19 (Release Notes)

We strongly recommend upgrading to this version to keep your environment secure.

Any customer using the Classic Web Client should upgrade to ZCS v10.1.19 as soon as possible, as this issue only impacts the users of Classic Web Client. 

The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened. If exploited, it could allow access to mailbox information, session data, or account settings.

We strongly recommend all customers to upgrade to ZCS v10.1.19 to ensure they have received the latest security patches, bug fixes, and enhancements.

If you require assistance applying these mitigations or have concerns regarding potential exposure, please raise a support ticket here.

The post Patch Release Update: Zimbra 10.1.19 appeared first on Zimbra : Blog.

Deployment Risk: Low

We have released Zimbra Version 10.1.17, bringing meaningful improvements across the Modern WebClient — from how you compose and read email to how you schedule meetings — along with fixes for ZCO, mobile, and server components, and several important security patches your teams should be aware of.

• Zimbra 10.1.17 (Release Notes)

We strongly recommend all admins and users to upgrade for improved stability and enhanced email compatibility.

What’s New in 10.1.17

• Voice Composer for Email: Dictate emails hands-free with system language detection and spoken punctuation — available in new, reply, and forward views. Enabled by admins via the voice-composer Zimlet.
• Smarter Calendar Scheduling: A redesigned event creation flow reduces scrolling for quicker scheduling. The new “Suggest a Time” feature shows participant availability and recommends optimal meeting slots as attendees are added.
• Enhanced Email Experience: View the latest emails first with a new thread order setting. Attachments are pinned to a dedicated top panel in thread view, and the composer now supports drag-and-drop attachments, multi-signature, and autosave with a cleaner layout.
• 2FA on Login Page: QR code now shown directly at login when 2FA is enforced, removing the need to visit preferences first.
• Desktop App Upgraded: Electron updated from 37 to 41, bringing improved security, performance, and compatibility with newer Chromium and Node.js versions.
• Ubuntu 24: Now fully supported as a GA release.

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.17 appeared first on Zimbra : Blog.

Summary 

• A regression in ZCS 10.1.15 causes zmpurgeoldmbox to delete external blobs (Scality, S3, OpenIO) after mailbox migration, even when zimbraMailboxMoveSkipBlobs=TRUE. 
• This results in permanent, irrecoverable email data loss on the destination server. 
• A fix is targeted for the 10.1.17 patch release. 
• Until then, do not run zmpurgeoldmbox after mailbox migrations if you use external or unified object storage. 

What Happened 

In ZCS 9.0, running zmpurgeoldmbox after a zmmboxmove correctly cleaned up only local metadata (MySQL + Lucene indexes) on the source server, leaving external blobs untouched. In ZCS 10.1.15, a code change inadvertently altered the logic that identifies external/centralized storage. As a result: 

• zmpurgeoldmbox now deletes external blobs even without the –forceDeleteBlobs flag 
• The destination server’s mailbox still references those deleted blobs 
• Affected users see “missing blob” errors and lose access to their emails permanently 

Am I Affected? 

You are affected if all of the following are true: 

1. You are running ZCS 10.1.15 or 10.1.16  
2. You use external object storage (Scality, S3, OpenIO, or similar) as a primary or secondary (HSM) volume — especially with unified storage enabled 
3. You perform mailbox migrations using zmmboxmove with blob-skipping attributes (zimbraMailboxMoveSkipBlobs=TRUE or zimbraMailboxMoveSkipHsmBlobs=TRUE) 
4. You run zmpurgeoldmbox on the source server after migration 

If you use only local (internal) storage and no external object storage, this issue does not affect you. 

Behavior Comparison: ZCS 9.0 vs 10.1.15 

* In ZCS 9.0, –forceDeleteBlobs was not implemented for external stores (Bug 96149). It is being properly implemented as part of the fix. 

Immediate Workaround 

• Do not run zmpurgeoldmbox (or PurgeMovedMailboxRequest via SOAP) after mailbox migrations if your environment uses external object storage. 
• Disable any automation or scripts that trigger zmpurgeoldmbox as part of post-migration cleanup. 
• Skipping the purge leaves residual local metadata (MySQL + Lucene) on the source server. This is harmless and can be cleaned up after the patch is applied. 
• zmmboxmove itself is not affected — mailbox migrations continue to work correctly. Only the post-migration purge step is problematic. 

The Fix 

The corrected behavior in 10.1.17 will be: 

• External blobs will only be deleted with an explicit –forceDeleteBlobs flag. 
• Targeted release: ZCS 10.1.17 patch.
• If you need an early-access build, contact Zimbra Support. 

What To Do Next 

1. Immediately stop running zmpurgeoldmbox after mailbox migrations in any environment with external storage. Disable related automation.
2. Audit recent migrations: if zmpurgeoldmbox was already run, verify blob integrity on the destination server using: 

zmprov gmi user@example.com 

zmblobchk -m <mailboxId> -v –output-used-blobs start 

If the output shows “blob not found” errors for external locators (containing @@), those blobs have been deleted. 

1. If data loss has occurred, check if your object storage provider supports versioning or soft-delete, there may be a recovery path. 
2. Plan for the 10.1.17 patch: after upgrading, you can safely resume zmpurgeoldmbox and clean up residual metadata from the workaround period. 

Questions? 

If you have questions, please contact Zimbra Support. 

Affected versions: ZCS 10.1.15 through 10.1.16 (all editions) 

Fix version: ZCS 10.1.17 (targeted) 

Tracking reference: ZBUG-5265 

Severity: Critical — potential data loss 

The post Product Advisory: zmpurgeoldmbox May Delete External Storage Blobs After Mailbox Migration appeared first on Zimbra : Blog.

In addition, this patch addresses multiple security vulnerabilities and Modern Web App improvements designed to streamline your email management and collaboration.

Patch Security Severity: High

Deployment Risk: High

• Zimbra 10.1.16 (Release Notes)

We strongly recommend all admins and users to upgrade to Zimbra 10.1.16 for improved stability and enhanced email compatibility.

Ubuntu 24 Support (Beta) is now available with this release.

Beta Notice: Beta features are unsupported and intended for lab/testing environments only. Do not deploy on production systems.

Additional Improvements and Fixed Issues

Additional Fixed Issues

• 20+ bug fixes across Modern Web App, Classic Web App, ActiveSync, EWS, Chat, and Zimbra Desktop improving stability and user experience.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.16 appeared first on Zimbra : Blog.

Deployment Risk: Low

We have released Zimbra Version 10.1.15, improving email rendering compatibility while maintaining critical security protections.

• Zimbra 10.1.15 (Release Notes)

We strongly recommend all admins and users to upgrade to Zimbra 10.1.15 for improved stability and enhanced email compatibility.

End of Life Notice: 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.15 appeared first on Zimbra : Blog.

We have released Zimbra Version 10.1.14 to address a critical issue in Version 10.1.13 that impacts IMAP synchronization across multi-server Zimbra environments, causing incorrect message display and synchronization failures.

For complete details and implementation guidance, please refer to our release notes:

• Zimbra 10.1.14 (Release Notes)

Customers on Version 10.1.13

Patch Security Severity: Low

Deployment Risk: Low

We strongly encourage all customers with a high IMAP user base who have upgraded to Version 10.1.13 to upgrade to Zimbra 10.1.14 immediately. Customers on Version 10.1.13 with a low IMAP usage pattern may continue using the current version and wait for the upcoming Version 10.1.15.

Customers on Version 10.1.12 or earlier

Patch Security Severity: High

Deployment Risk: Low

Customers currently on Patch Version 10.1.12 or earlier are recommended to upgrade directly to Version 10.1.14 for improved stability and fixes.

This new patch version also resolved slowdown issues when switching to the Zimbra user post-upgrade to Version 10.1.13. User switching is now significantly faster and more responsive through optimized license data caching.

End of Life Notice: Zimbra 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Emergency Patch Release: Zimbra 10.1.14 appeared first on Zimbra : Blog.

Deployment Risk: Medium

This patch fixes a stored cross-site scripting (XSS) vulnerability and enhances protection by upgrading AntiSamy to version 1.7.8 and removing the outdated code. It includes critical fixes and user experience improvements for the following editions:

• Zimbra 10.1.13 (Release Notes)
• Zimbra 10.0.18 (Release Notes)

We recommend all administrators and users to apply this update to strengthen your system’s stability and ensures uninterrupted service performance.

Communication & Collaboration

• Ignite: Smart email search with instant suggestions and LDAP-supported external email warning
• Modern Web App: Improved drag-and-drop, calendar management, tag organization, dumpster functionality, and POP/IMAP settings in Modern UI
• Zimbra Connector for Outlook (ZCO): Outlook 2024 compatibility, better meeting proposals and shared folder handling
• ActiveSync & Exchange Web Services (EWS): Reliable iOS attachments and consistent calendar sync across all devices. Following Microsoft’s recent announcement extending Legacy EWS support to October 2026 (from the previous October 2025 deadline), Zimbra will maintain EWS compatibility across all currently supported Outlook versions, ensuring uninterrupted service for Outlook clients using this protocol.
• Chat and Video: Chat zimlets and extensions have been updated with the latest improvements. Chat installer zfzi-2.0.1 is now available, and the customization version has been updated to 10.2.1, bringing enhanced performance and bug fixes.

Modern UI Enhancements

• POP/IMAP Management: Users can now manage email access settings directly from Modern Webmail, including on mobile.
• Copy-Paste Formatting: Content from Excel, PowerPoint, Word, and web pages now keeps its formatting when pasted into emails.
• Meeting Control: Meeting organizers can now customize cancellation messages and choose to cancel single meetings or entire series. Users now have ‘Edit Message’ option to personalize their messages before responding.
• Enhanced Recovery: Restore deleted emails, contacts, appointments, and files directly from Trash.
• Quick Distribution List View: See all members of a distribution list instantly from the message preview without having to switch views.
• Improved Tags: Tags now work consistently across all features with bug fixes.
• Drag-and-Drop Uploads: Easily drag files into Briefcase, just like in Classic UI.
• One-Click Recipient Removal: Remove any recipient (To, Cc, Bcc, or invitee) by clicking the “X” next to their name across Mail, Calendar, Briefcase, and Contacts.
• Redesigned Tag Management: Cleaner interface makes creating and organizing tags easier with better visuals and accessibility.
• Visual Drop Indicators: Clear highlighting shows exactly where items will land when dragging and dropping across Mail, Briefcase, and Contacts.

Security Updates

• Enhanced S3 data management and cleanup for mailbox moves
• Strengthened TLS handling per updated RFC standards

Performance Optimizations

• Faster email thread loading with Smart Conversation Loading
• Improved performance for large folders sets in Mail and Briefcase
• Optimized Briefcase memory management

End of Life Notice: 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.13, 10.0.18 appeared first on Zimbra : Blog.