Zimbra urges: Fix critical email security flaws

Email and collaboration platform Zimbra has urged Philippine organizations to address actively exploited email server vulnerabilities within 24 to 72 hours to reduce exposure to cyberattacks.

The company warned that delaying security updates, particularly for internet-facing systems, could leave businesses and government agencies vulnerable to breaches.

Citing data from Viettel Cyber Security, Zimbra said 34,650 new software vulnerabilities were disclosed worldwide in the first half of 2026, including 77 classified as high impact for products and services widely used in the Philippines.

Bret Cunningham, chief product officer at Zimbra’s parent company Synacor, said organizations must prioritize security threats based on their severity and potential impact.

“No organization can fix everything at once, which means prioritization is a leadership decision as much as a technical one,” Cunningham said.

He stressed that organizations managing their own email infrastructure must establish clear procedures for addressing critical vulnerabilities.

“For banks, energy providers and government agencies, they should already know which vulnerabilities justify emergency change and who has authority to approve it,” he added.

Zimbra recommended a five-step security approach involving standardized server configurations, continuous threat monitoring, risk-based prioritization, established remediation deadlines and verification of security fixes.

The company said organizations should disable unnecessary software, restrict administrator access, encrypt connections and regularly monitor security advisories.

Vulnerabilities already being exploited should be addressed within 24 to 72 hours, while lower-risk weaknesses may follow longer remediation schedules.

Zimbra also emphasized the need to investigate possible breaches even after security patches have been installed.

“Patch records show how an organization handled the vulnerabilities it knew about,” Cunningham said.