Zimbra

In 2024, Zimbra was hit by a significant cyber attack due to a Remote Code Execution (RCE) vulnerability, labeled CVE-2024-45519. The flaw in Zimbra’s postjournal service allowed attackers to send specially crafted emails, enabling remote command execution on affected systems. While the postjournal service isn’t active by default, its use in many setups made Zimbra an attractive target, especially since some instances lacked up-to-date security patches. To mitigate these risks, Zimbra released patches for affected versions, including updates to 9.0.0, 10.0.9, and others.

The closed source variant Network edition is distributed under the Zimbra Network Edition EULA.

Starting with version 8.5 the Zimbra source code is available under the terms of the GNU General Public License version 2 (backend) and the Common Public Attribution License version 1 (frontend).

Previous versions were released under the Zimbra Public License (ZPL). The Free Software Foundation accepts the license as being a free software license and refers to it as being identical to the Yahoo! Public License with the exception that Zimbra, Inc. provides the license, rather than Yahoo!.

With later versions of Zimbra, while most of its components remain being open-source, there's no longer free official binary builds of Zimbra published to download and use. On this matter, in response to the question "Is Zimbra still an Open-Source product?", the FAQ section on the Zimbra website states: Zimbra continues to maintain most of its products as a full open-source initiative. The binaries, however, will no longer be free to download and use.