Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol (SNMP) monitoring component. As many as nine security vulnerabilities have been patched in Zimbra 10.1.20. Topping the list is a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled. Also patched

The article reports that Zimbra 10.1.20 patches nine vulnerabilities, including a critical unauthenticated command injection flaw in the SNMP monitoring component when SNMP notifications are enabled, and four XSS bugs in the Classic Web Client, plus a mail forwarding restriction bypass (CVE-2026-50055).[1][2][3] These flaws could allow remote arbitrary command execution on the server, session hijacking and unauthorized actions via XSS, and exfiltration of email even when forwarding restrictions are in place.[1][2][3] From a RealGround perspective, these issues highlight software supply-chain risk for any AI or agent workflows integrated with Zimbra: compromise of the email/collaboration layer can be used to tamper with prompts and data flows to AI agents, or to move laterally into AI infrastructure. Organizations should treat Zimbra as a critical upstream dependency, ensure timely patching, and incorporate it into SBOM-driven AI supply-chain analysis and ongoing red teaming to detect email- and XSS-based routes to AI agent manipulation or data leakage.