Zimbra 10.1.20 turns a June SNMP advisory into a real fix, and queues four XSS patches

Zimbra has shipped Collaboration Suite 10.1.20, which it says contains a permanent fix for the critical SNMP vulnerability disclosed in its security advisory of 26 June 2026 ^[1][3][4]. The word "permanent" is the operational tell: whatever administrators did in June, the fix was not in the binaries, and it is now.

The SNMP entry is described as a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled ^[4]. That is a conditional exposure rather than a default one, and the condition is the sort of thing that gets turned on once during a monitoring rollout and never reviewed again. Zimbra rates the patch's security severity High and its deployment risk Low ^[2], which is as close as vendors get to saying there is no good reason to sit on this one.

Beyond SNMP, the release notes list four separate cross-site scripting issues, all in the Classic Web Client ^[18]. One is a stored XSS in which malicious attachment filenames could execute script under specific conditions ^[5]. The other three cover crafted fields that could execute malicious script under specific conditions ^[6], a crafted field that could execute script when rendered ^[7], and crafted attachments that could execute script when rendered ^[8]. Four client-side bugs in the same client, fixed in the same release, is a pattern worth noting for anyone still serving the Classic interface to a general user population.

The rest of the security list is quieter but touches trust boundaries that matter in mail. There is a mail forwarding restriction bypass that Zimbra says could allow authenticated users to exfiltrate email despite mail forwarding restrictions being enabled ^[9]. There is a security issue in the EWS extension related to access controls ^[10], an authorization issue in mailbox delegation ^[11], and a server-side request forgery vulnerability in the Nextcloud integration ^[12]. In total the post enumerates nine security fixes ^[19]. Data-loss-prevention teams who treat forwarding restrictions as a control rather than a nudge should read ^[9] as a finding about their own assumptions, not just Zimbra's code.

Two non-security fixes ride along. Zimbra says it corrected "Reset to COS Value" in licensing so that feature usage counts restore correctly instead of resetting to zero ^[14], and fixed admin mail redirects being blocked when user forwarding restrictions are switched on under very specific conditions ^[15].

What the post does not give you is detail. Zimbra states that, in line with industry best practices, information disclosure is limited for security vulnerability fixes ^[13], and the release notes carry no CVE identifiers and no statement about exploitation in the wild ^[20]. That leaves defenders with severity labels and one-line descriptions as the entire basis for prioritisation, which is workable for patching and useless for detection engineering or retrospective log review.

Watch for CVE assignments and any fuller advisory text against the SNMP command injection, since a permanent fix arriving weeks after initial disclosure is the window in which proof-of-concept code usually surfaces. Watch your own SNMP notification configuration before assuming the flaw was never reachable. And check whether the June response was recorded as closed in your change system; a mitigation logged as a resolution is how 10.1.20 quietly fails to get installed. Zimbra says it strongly recommends upgrading ^[16] and points sites that need help, or that have exposure concerns, at its support ticket queue ^[17].