Deployment Risk: Low

We have released Zimbra Collaboration Suite (ZCS) v10.1.20.

This release contains fixes for multiple critical security issues including a permanent fix for the critical SNMP vulnerability disclosed in our recent security advisory. The release also includes bug fixes in licensing and mail filtering.

• Zimbra 10.1.20 (Release Notes)

We strongly recommend upgrading to this version to keep your environment secure.

Critical Security Fixes

The following issues are fixed in this release:

• A command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled. (Permanent fix for the vulnerability disclosed in our security advisory on 26th June 2026)
• A stored cross-site scripting (XSS) vulnerability in the Classic Web Client that could allow malicious attachment filenames to execute script under specific conditions.
• A XSS vulnerability in the Classic Web Client where crafted fields could execute malicious script under specific conditions.
• A XSS vulnerability in the Classic Web Client where a crafted field could execute malicious script when rendered.
• A XSS vulnerability in the Classic Web Client where crafted attachments could execute malicious script when rendered.
• A mail forwarding restriction bypass that could allow authenticated users to exfiltrate email despite mail forwarding restrictions being enabled.
• A security issue in the EWS extension related to access controls.
• An authorization issue in mailbox delegation.
• A server-side request forgery (SSRF) vulnerability in the Nextcloud integration.

Note: In line with industry best practices, information disclosure is limited for security vulnerability fixes. 

Other Bug Fixes

• Licensing: Corrected “Reset to COS Value” so feature usage counts restore correctly instead of resetting to zero.
• Mail Forwarding: Fixed admin mail redirects being blocked when user forwarding restrictions are switched on under very specific conditions.

If you require assistance applying the new patch or have concerns regarding potential exposure, please raise a support ticket here.

The post Patch Release Update: Zimbra 10.1.20 appeared first on Zimbra : Blog.

Deployment Risk: Low

We have released Zimbra 10.1.19 to address a critical security vulnerability which impacts the Classic Web Client:

• Zimbra 10.1.19 (Release Notes)

We strongly recommend upgrading to this version to keep your environment secure.

Any customer using the Classic Web Client should upgrade to ZCS v10.1.19 as soon as possible, as this issue only impacts the users of Classic Web Client. 

The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened. If exploited, it could allow access to mailbox information, session data, or account settings.

We strongly recommend all customers to upgrade to ZCS v10.1.19 to ensure they have received the latest security patches, bug fixes, and enhancements.

If you require assistance applying these mitigations or have concerns regarding potential exposure, please raise a support ticket here.

The post Patch Release Update: Zimbra 10.1.19 appeared first on Zimbra : Blog.

Deployment Risk: Low

We have released Zimbra Version 10.1.17, bringing meaningful improvements across the Modern WebClient — from how you compose and read email to how you schedule meetings — along with fixes for ZCO, mobile, and server components, and several important security patches your teams should be aware of.

• Zimbra 10.1.17 (Release Notes)

We strongly recommend all admins and users to upgrade for improved stability and enhanced email compatibility.

What’s New in 10.1.17

• Voice Composer for Email: Dictate emails hands-free with system language detection and spoken punctuation — available in new, reply, and forward views. Enabled by admins via the voice-composer Zimlet.
• Smarter Calendar Scheduling: A redesigned event creation flow reduces scrolling for quicker scheduling. The new “Suggest a Time” feature shows participant availability and recommends optimal meeting slots as attendees are added.
• Enhanced Email Experience: View the latest emails first with a new thread order setting. Attachments are pinned to a dedicated top panel in thread view, and the composer now supports drag-and-drop attachments, multi-signature, and autosave with a cleaner layout.
• 2FA on Login Page: QR code now shown directly at login when 2FA is enforced, removing the need to visit preferences first.
• Desktop App Upgraded: Electron updated from 37 to 41, bringing improved security, performance, and compatibility with newer Chromium and Node.js versions.
• Ubuntu 24: Now fully supported as a GA release.

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.17 appeared first on Zimbra : Blog.

Summary 

• A regression in ZCS 10.1.15 causes zmpurgeoldmbox to delete external blobs (Scality, S3, OpenIO) after mailbox migration, even when zimbraMailboxMoveSkipBlobs=TRUE. 
• This results in permanent, irrecoverable email data loss on the destination server. 
• A fix is targeted for the 10.1.17 patch release. 
• Until then, do not run zmpurgeoldmbox after mailbox migrations if you use external or unified object storage. 

What Happened 

In ZCS 9.0, running zmpurgeoldmbox after a zmmboxmove correctly cleaned up only local metadata (MySQL + Lucene indexes) on the source server, leaving external blobs untouched. In ZCS 10.1.15, a code change inadvertently altered the logic that identifies external/centralized storage. As a result: 

• zmpurgeoldmbox now deletes external blobs even without the –forceDeleteBlobs flag 
• The destination server’s mailbox still references those deleted blobs 
• Affected users see “missing blob” errors and lose access to their emails permanently 

Am I Affected? 

You are affected if all of the following are true: 

1. You are running ZCS 10.1.15 or 10.1.16  
2. You use external object storage (Scality, S3, OpenIO, or similar) as a primary or secondary (HSM) volume — especially with unified storage enabled 
3. You perform mailbox migrations using zmmboxmove with blob-skipping attributes (zimbraMailboxMoveSkipBlobs=TRUE or zimbraMailboxMoveSkipHsmBlobs=TRUE) 
4. You run zmpurgeoldmbox on the source server after migration 

If you use only local (internal) storage and no external object storage, this issue does not affect you. 

Behavior Comparison: ZCS 9.0 vs 10.1.15 

* In ZCS 9.0, –forceDeleteBlobs was not implemented for external stores (Bug 96149). It is being properly implemented as part of the fix. 

Immediate Workaround 

• Do not run zmpurgeoldmbox (or PurgeMovedMailboxRequest via SOAP) after mailbox migrations if your environment uses external object storage. 
• Disable any automation or scripts that trigger zmpurgeoldmbox as part of post-migration cleanup. 
• Skipping the purge leaves residual local metadata (MySQL + Lucene) on the source server. This is harmless and can be cleaned up after the patch is applied. 
• zmmboxmove itself is not affected — mailbox migrations continue to work correctly. Only the post-migration purge step is problematic. 

The Fix 

The corrected behavior in 10.1.17 will be: 

• External blobs will only be deleted with an explicit –forceDeleteBlobs flag. 
• Targeted release: ZCS 10.1.17 patch.
• If you need an early-access build, contact Zimbra Support. 

What To Do Next 

1. Immediately stop running zmpurgeoldmbox after mailbox migrations in any environment with external storage. Disable related automation.
2. Audit recent migrations: if zmpurgeoldmbox was already run, verify blob integrity on the destination server using: 

zmprov gmi user@example.com 

zmblobchk -m <mailboxId> -v –output-used-blobs start 

If the output shows “blob not found” errors for external locators (containing @@), those blobs have been deleted. 

1. If data loss has occurred, check if your object storage provider supports versioning or soft-delete, there may be a recovery path. 
2. Plan for the 10.1.17 patch: after upgrading, you can safely resume zmpurgeoldmbox and clean up residual metadata from the workaround period. 

Questions? 

If you have questions, please contact Zimbra Support. 

Affected versions: ZCS 10.1.15 through 10.1.16 (all editions) 

Fix version: ZCS 10.1.17 (targeted) 

Tracking reference: ZBUG-5265 

Severity: Critical — potential data loss 

The post Product Advisory: zmpurgeoldmbox May Delete External Storage Blobs After Mailbox Migration appeared first on Zimbra : Blog.

In addition, this patch addresses multiple security vulnerabilities and Modern Web App improvements designed to streamline your email management and collaboration.

Patch Security Severity: High

Deployment Risk: High

• Zimbra 10.1.16 (Release Notes)

We strongly recommend all admins and users to upgrade to Zimbra 10.1.16 for improved stability and enhanced email compatibility.

Ubuntu 24 Support (Beta) is now available with this release.

Beta Notice: Beta features are unsupported and intended for lab/testing environments only. Do not deploy on production systems.

Additional Improvements and Fixed Issues

Additional Fixed Issues

• 20+ bug fixes across Modern Web App, Classic Web App, ActiveSync, EWS, Chat, and Zimbra Desktop improving stability and user experience.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.16 appeared first on Zimbra : Blog.

Deployment Risk: Low

We have released Zimbra Version 10.1.15, improving email rendering compatibility while maintaining critical security protections.

• Zimbra 10.1.15 (Release Notes)

We strongly recommend all admins and users to upgrade to Zimbra 10.1.15 for improved stability and enhanced email compatibility.

End of Life Notice: 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.15 appeared first on Zimbra : Blog.

We have released Zimbra Version 10.1.14 to address a critical issue in Version 10.1.13 that impacts IMAP synchronization across multi-server Zimbra environments, causing incorrect message display and synchronization failures.

For complete details and implementation guidance, please refer to our release notes:

• Zimbra 10.1.14 (Release Notes)

Customers on Version 10.1.13

Patch Security Severity: Low

Deployment Risk: Low

We strongly encourage all customers with a high IMAP user base who have upgraded to Version 10.1.13 to upgrade to Zimbra 10.1.14 immediately. Customers on Version 10.1.13 with a low IMAP usage pattern may continue using the current version and wait for the upcoming Version 10.1.15.

Customers on Version 10.1.12 or earlier

Patch Security Severity: High

Deployment Risk: Low

Customers currently on Patch Version 10.1.12 or earlier are recommended to upgrade directly to Version 10.1.14 for improved stability and fixes.

This new patch version also resolved slowdown issues when switching to the Zimbra user post-upgrade to Version 10.1.13. User switching is now significantly faster and more responsive through optimized license data caching.

End of Life Notice: Zimbra 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Emergency Patch Release: Zimbra 10.1.14 appeared first on Zimbra : Blog.

Deployment Risk: Medium

This patch fixes a stored cross-site scripting (XSS) vulnerability and enhances protection by upgrading AntiSamy to version 1.7.8 and removing the outdated code. It includes critical fixes and user experience improvements for the following editions:

• Zimbra 10.1.13 (Release Notes)
• Zimbra 10.0.18 (Release Notes)

We recommend all administrators and users to apply this update to strengthen your system’s stability and ensures uninterrupted service performance.

Communication & Collaboration

• Ignite: Smart email search with instant suggestions and LDAP-supported external email warning
• Modern Web App: Improved drag-and-drop, calendar management, tag organization, dumpster functionality, and POP/IMAP settings in Modern UI
• Zimbra Connector for Outlook (ZCO): Outlook 2024 compatibility, better meeting proposals and shared folder handling
• ActiveSync & Exchange Web Services (EWS): Reliable iOS attachments and consistent calendar sync across all devices. Following Microsoft’s recent announcement extending Legacy EWS support to October 2026 (from the previous October 2025 deadline), Zimbra will maintain EWS compatibility across all currently supported Outlook versions, ensuring uninterrupted service for Outlook clients using this protocol.
• Chat and Video: Chat zimlets and extensions have been updated with the latest improvements. Chat installer zfzi-2.0.1 is now available, and the customization version has been updated to 10.2.1, bringing enhanced performance and bug fixes.

Modern UI Enhancements

• POP/IMAP Management: Users can now manage email access settings directly from Modern Webmail, including on mobile.
• Copy-Paste Formatting: Content from Excel, PowerPoint, Word, and web pages now keeps its formatting when pasted into emails.
• Meeting Control: Meeting organizers can now customize cancellation messages and choose to cancel single meetings or entire series. Users now have ‘Edit Message’ option to personalize their messages before responding.
• Enhanced Recovery: Restore deleted emails, contacts, appointments, and files directly from Trash.
• Quick Distribution List View: See all members of a distribution list instantly from the message preview without having to switch views.
• Improved Tags: Tags now work consistently across all features with bug fixes.
• Drag-and-Drop Uploads: Easily drag files into Briefcase, just like in Classic UI.
• One-Click Recipient Removal: Remove any recipient (To, Cc, Bcc, or invitee) by clicking the “X” next to their name across Mail, Calendar, Briefcase, and Contacts.
• Redesigned Tag Management: Cleaner interface makes creating and organizing tags easier with better visuals and accessibility.
• Visual Drop Indicators: Clear highlighting shows exactly where items will land when dragging and dropping across Mail, Briefcase, and Contacts.

Security Updates

• Enhanced S3 data management and cleanup for mailbox moves
• Strengthened TLS handling per updated RFC standards

Performance Optimizations

• Faster email thread loading with Smart Conversation Loading
• Improved performance for large folders sets in Mail and Briefcase
• Optimized Briefcase memory management

End of Life Notice: 10.0

Zimbra 10.0 will reach End of Life on December 31, 2025. Customers using this version are advised to plan their upgrade/migration to the 10.1 version (our current supported version) to ensure continued security updates and access to the latest features. For assistance during this transition, our support team is available to address any inquiries.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.13, 10.0.18 appeared first on Zimbra : Blog.

Patch Security Severity: High

Deployment Risk: Low

This patch fixes a critical security vulnerability related to a Server-Side Request Forgery (SSFR) in the chat proxy configuration. 

We recommend all users and administrators, especially those on Zimbra versions 10.1.5 to 10.1.11 to apply this update immediately. It will strengthen your system’s stability and ensures uninterrupted service performance:

• Zimbra 10.1.12 (Release Notes)

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Emergency Patch Release: Zimbra 10.1.12 appeared first on Zimbra : Blog.

Deployment Risk: Low

This patch updated on August 8th, 2025 includes hotfix for the following editions:

• Zimbra 10.1.11 (Release Notes)
• Zimbra 10.0.17 (Release Notes)

Hotfix for 10.1.11 & 10.0.17

ActiveSync: Resolves an issue that was affecting the iOS Mail app, ensuring improved functionality for all users. We recommend applying this hotfix for a seamless experience.

Customer Feedback Portal

Vote on suggested features, propose your own and stay updated with our product roadmap. Join us at pm.zimbra.com, our dedicated customer portal, for product feedback. Contribute to Zimbra’s evolution!

The post Patch Release Update: Zimbra 10.1.11, 10.0.17 appeared first on Zimbra : Blog.