CVE-2026-50055Medium· 6.5▾ TwilightPoC availableA policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
1 GitHub repo (last check)
A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93629Medium· 5.3Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity
CVE-2026-93627Medium· 5.3Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer
CVE-2026-93628Medium· 5.3Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response
CVE-2026-93630Medium· 4.3Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
CVE-2026-93631High· 7.1Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking
CVE-2026-93636Medium· 4.3Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name