Critical Zimbra Flaw Lets Attackers Inject Commands Through the SNMP Monitoring Service

Zimbra released version 10.1.20 to address a critical SNMP-based command injection vulnerability in the Zimbra Collaboration Suite that can allow remote attackers to execute arbitrary commands via malicious SNMP notifications; the update also fixes multiple XSS, an SSRF in Nextcloud integration, authorization issues, and a mail-forwarding bypass, and administrators are urged to upgrade, harden SNMP configurations, and monitor for suspicious activity.