# Zimbra 10.1.20 Patches Critical Security Vulnerabilities Nine flaws fixed, including a critical SNMP monitoring command injection issue. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-07-21 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/a03ae2dd-2e2c-4c1f-9d82-202b05e42402 ## Critical Command Injection Vulnerability Zimbra 10.1.20 addresses a critical command injection flaw in the SNMP monitoring component. This vulnerability affects systems with SNMP notifications enabled, potentially allowing attackers to execute arbitrary commands. Users are strongly advised to update to the latest version immediately. ## XSS Vulnerabilities and Impacts The update also fixes multiple cross-site scripting (XSS) vulnerabilities in the Classic Web Client. These flaws could allow malicious scripts to execute via crafted attachment filenames or fields. Attackers could exploit these to access user sessions or sensitive data. ## Email Forwarding Restriction Bypass Version 10.1.20 resolves an issue where authenticated users could bypass email forwarding restrictions, potentially exfiltrating emails despite configured policies. This posed a significant risk for corporate data leaks and required urgent patching. ## EWS and Mailbox Authorization Issues The release tackles access control problems in the EWS extension and mailbox delegation authorization. These vulnerabilities could let unauthorized users access sensitive data or exceed their permissions—a critical concern for system administrators. ## SSRF Flaw in Nextcloud Integration Zimbra patched a server-side request forgery (SSRF) vulnerability in its Nextcloud integration. This flaw might enable attackers to access internal network resources or leak sensitive data. Organizations using this integration must update without delay. ## Previous Updates and Continuity Earlier in July, Zimbra released version 10.1.19 to fix a critical stored XSS flaw in the Classic Web Client. These consistent updates demonstrate Zimbra's commitment to rapid vulnerability remediation. Keeping systems updated remains crucial for all users. ## Sources covering this story - https://securityaffairs.com/195752/security/zimbra-10-1-20-patches-multiple-security-issues-including-a-critical-command-injection-bug.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._