Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Zimbra has released security updates to address multiple vulnerabilities in its email platform, including a critical command injection flaw in the SNMP monitoring component and four cross-site scripting (XSS) vulnerabilities in the Classic Web Client. The command injection could allow remote code execution, while the XSS flaws could enable malicious scripts via crafted attachments or fields. Additionally, a mail forwarding restriction bypass vulnerability was patched. Although no active exploitation has been reported, historical abuse of similar flaws underscores the importance of prompt patching.

AI-extracted · verify before operational use