Rapid7 disclosed 17 Zimbra Collaboration Suite flaws, including CVE-2026-10632 and CVE-2026-93640, allowing XSS and root privilege escalation. Related Posts: Apple iOS 27.2 Update Fixes 160 Security Flaws CISA Adds PHP2Shell to KEV as Confirmed RCE Attacks and Suspected DPRK Scanning Surface Apple Backports Fix for Exploited CoreGraphics Zero-Day CVE-2026-86950 to Older iPhones The post Rapid7 Discloses 17 Zimbra Collaboration Suite Vulnerabilities Breaking Identity Boundaries appeared first

Zimbra CVE-2026-73570 lets one crafted email run code. Microsoft details the Zimbra command injection attacks: web shells, root access, and key theft. Related Posts: PoC Exploit Released for Next.js RCE Flaw CVE-2026-94545 ASUS Security Vulnerabilities Expose Routers and Motherboards MediaWiki External Data CVE-2026-100382 (CVSS 10) Unauthenticated RCE Exploited in the Wild, PoC Public The post Microsoft Tracks Zimbra CVE-2026-73570 Attacks That Steal Mail and Auth Keys appeared first on Dail

Russian hackers from the TA488 group exploited a Zimbra webmail flaw triggered when emails were opened or previewed, stealing credentials and up to 90 days of messages from victims.