Zimbra 10.1.20 patches nine, SNMP injection at the top

News. Vendor advisory, Zimbra blog, 2026-07-20, covered by The Hacker News, 2026-07-21. Zimbra shipped 10.1.20 on Sunday. Nine security fixes in one release. The one to lead with: a command injection in the SNMP monitoring component that fires when SNMP notifications are enabled.

What actually got fixed

Zimbra’s release notes group the fixes without CVE numbers — at press time neither Zimbra’s blog nor NVD have published CVE IDs for these, so I’m not going to make any up. The classes are enough to prioritize the patch:

• SNMP command injection. In the monitoring component, triggered when SNMP notifications are configured. Zimbra’s own severity label on the release is “High.” If SNMP notifications are on, this one carries the release.
• Four XSS bugs in the Classic Web Client. Delivered through crafted attachments and message fields. This is the third consecutive patch release with Classic Web Client XSS — 10.1.19 had one, 10.1.20 has four. See our July 11 coverage for the last round.
• Mail forwarding restriction bypass. Authenticated users can exfiltrate mail past forwarding restrictions the admin set. Credit to Jonah Burgess of Rapid7 via The Hacker News.
• EWS extension access-control flaw. Not fully described in the advisory.
• Mailbox delegation authorization bug. Also thin on detail.
• SSRF in the Nextcloud integration. If you’ve wired Zimbra to Nextcloud, this one matters more than it sounds — SSRF from a mail server sitting on a management VLAN gets ugly fast.

Priority call

Patch order I’d actually run tonight if you self-host Zimbra:

1. Anyone with SNMP notifications enabled — patch first. Command injection in a monitoring path is the fastest one to weaponize once details drop. Zimbra rates the overall release “High” severity and “Low” deployment risk, so this is a cheap upgrade.
2. Anyone exposing the Classic Web Client to the public internet — patch next. Four fresh XSS bugs in one release, and stored XSS in webmail has an ugly history of being paired with session-theft chains (that’s how the Google TAG report on 10.1.19 landed). Migrating users to the Modern UI has been Zimbra’s stated direction for a while — this release is another reason to finish that.
3. Anyone running the Nextcloud integration — patch, and audit outbound requests from the mail server in the meantime. SSRF from a server that usually has broader network reach than a plain webmail host is worth paying attention to even before you patch.
4. Everyone else — patch this week. Nothing here has confirmed exploitation as of this writing, but four of the nine are in the web-facing UI and history says that class gets picked up quickly once anyone reverse-engineers the diff.

What to watch

Zimbra hasn’t published CVE assignments yet. Once IDs land and NVD publishes records, we’ll add CVE entries linking back to this piece. If you can’t patch to 10.1.20 immediately, the honest compensating controls are:

• Disable SNMP notifications on Zimbra hosts until you upgrade — that removes the command-injection path entirely.
• Restrict Classic Web Client access to VPN or SSO-gated ranges. Not a fix, but it shrinks the attack surface on the XSS bugs.
• If you don’t need the Nextcloud integration, disable it until the SSRF patch is on.

Release notes: wiki.zimbra.com/wiki/Zimbra_Releases/10.1.20. Patch. That’s the whole memo.