Zimbra is the Ajax groupware that wanted to be Linux's Exchange. Born as LiquidSys in 2003, it became Zimbra Inc. on 26 July 2005, and its name came from the song I Zimbra by Talking Heads. In September 2007 Yahoo bought it for US$ 350 million. Then: VMware, Telligent, Synacor. On 31 August 2026 the stable series is 10.1.21 (Daffodil). The server is still Postfix + Java + OpenLDAP — the same combination as in 2005, with different owners.
LiquidSys, Onebox and Web 2.0
Satish Dharmaraj (CEO), Ross Dargahi (engineering) and Roland Schemers (technology) had worked on unified messaging at Onebox in 1999. In 2003 they founded LiquidSys in San Mateo. The thesis, in the 2007 podcast with Read/WriteWeb: people spend more time in email than in search or the browser. Gmail was a year old. The message was Ajax pushed to the limit — tooltips, dragging, right-click menus — on a server the admin installed on Linux, not in a Google datacenter.
On 26 July 2005 the company became Zimbra. Scott Dietzen, later president and CTO, explained on the blog: the name comes from I Zimbra, Talking Heads, 1979. On 12 September LWN reported the open source beta. On 4 October, at the Web 2.0 Conference, the official press release: Zimbra Collaboration Suite in beta, GA expected in November. Funding: Accel, Benchmark, Redpoint and Eric Hahn (former Netscape CTO), around US$ 16 million in Series A and B.
3.0 GA and what the server is
General availability arrived on 7–8 February 2006, as ZCS 3.0: group calendars, Zimlets (Wikipedia, search, Amazon), REST, PST import, Exchange migration. Platforms: Fedora, RHEL 4, SUSE, Debian, Mac OS X. In August 2006 version 4.0 brought Zimbra Documents (text and spreadsheets in the browser, ALE — Ajax Linking and Embedding).
The server was never “just another webmail”. It's a collaboration appliance: Postfix MTA, OpenLDAP directory, database (MySQL, then MariaDB in 8.5), Lucene search, Jetty (from 5 onward; previously Tomcat), nginx in front (since 5.0), ClamAV + SpamAssassin + Amavis, OpenDKIM since 8. SOAP in the API, IMAP and POP3 for thin clients. CalDAV, CardDAV, S/MIME. The thick client is Ajax on the web; Outlook and ActiveSync stayed on the paid side for years.
Two editions from the start: Open Source Edition (free, initially MPL/ZPL) and Network Edition (EULA, MAPI connector, native sync). The 2005 price: US$ 28 per mailbox/year on Network.
Yahoo, US$ 350 million
On 17 September 2007 Yahoo bought Zimbra. Two years from the Web 2.0 launch to the check. The source license became Yahoo Public License. The code disappeared from SourceForge; downloads continued on the website. Yahoo's idea was groupware for the hosting business. Google took the consumer market. In 2010 Yahoo “shed non-core assets”.
VMware, Telligent, Synacor
On 12 January 2010 VMware bought Zimbra from Yahoo. Ashlee Vance in the Times: a jab at Microsoft Exchange. 7.0 dropped Mac OS X Server. Kevin Henrikson later described both integrations as disasters: at Yahoo the startup ignored the buyer; at VMware vSphere printed money and the US$ 50 million email business was irrelevant.
In July 2013 Telligent Systems bought it from VMware and in September became Zimbra, Inc. again. On 18 August 2015 Synacor (Buffalo, NY) announced the acquisition. It remains the owner today. In 2019 the product dropped “Suite” and became simply Zimbra Collaboration.
Desktop — the free native client — stopped under VMware in 2013, returned in 2014 and died for good around 2019. 8.5 (2014) added HTML5 offline mode to the web client instead.
Licensing, FOSS and the binary that disappeared
Until 8.5 the source used MPL/ZPL/YPL. 8.5 opened the backend under GPL-2 and the frontend under CPAL-1. The FSF considers ZPL free. Synacor's current FAQ sends another message: the product “remains open source”, but official binaries are no longer free to download and use. Network Edition requires a key; 10.1 requires a new key, even for a trial.
The community builds FOSS from github.com/Zimbra/zm-build. There is an embargo: the wiki lists weeks between the Network patch and FOSS source. Third-party builds (Maldua and others) fill the gap. Anyone running the free tarball from 2010 discovered in the decade of 2020 that “open source” and “official ISO without login” aren't the same thing.
Joule, Kepler, Daffodil
The scientific/floral codenames:
- 8.8.15 Joule — GA 22 July 2019, the LTS installed all over Brazil. Guidance until 31/12/2024.
- 9 Kepler — GA 7 April 2020. EOS extended until 30/06/2025.
- 10 Daffodil — GA 8 March 2023. 10.1 (16 July 2024) changed licensing. General Support for 10.1.x until 31/12/2027.
10 removed Zextras' NG modules (backup, HSM, ActiveSync, delegated admin) and put the functionality in the core. Upgrading from 8.8.15/9 requires the NG migration tool. On 31 August 2026 the patch is 10.1.21.
On this blog, the 2017 howto still points to 8.7: Installing Zimbra 8.7.1 on Ubuntu and the note on 8.7.7. Those posts retained their identity; the 2026 series is 10.1.
The price of HTML, again
Groupware with webmail presents an XSS and parser RCE attack surface. In 2024 CVE-2024-45519 (RCE in the postjournal service, which isn't enabled by default) became a case. But the episode of interest to Brazilian readers is another one.
CVE-2025-27915 is a stored XSS in the Classic Web Client: the client didn't sanitize HTML inside .ics calendar files. Opening the message was enough — JavaScript fired through an ontoggle event inside a <details> tag and ran in the victim's session, able to create a filter forwarding the entire mailbox to the attacker. Zimbra fixed it on 27 January 2025, in versions 9.0.0 Patch 44, 10.0.13 and 10.1.5.
Eight months later, on 30 September 2025, StrikeReady Labs published that the flaw had been used as a zero-day in a campaign targeting the Brazilian Armed Forces, with .ics attachments sent by a sender impersonating the Libyan Navy's Protocol Office. Zimbra responded that it found no evidence of exploitation against Brazilian entities — the disagreement remains. What's undisputed: CISA added the CVE to the KEV catalog and set a remediation deadline for US federal agencies. In July 2026 another stored XSS in the same class appeared, patched in 10.1.19.
The message is the same as with Roundcube: an overdue webmail patch means an open inbox. And notice the interval — the fix had existed since January; those attacked were running an unpatched version. Unsupported 8.8.15 and 9 aren't nostalgia, they're holes.
On Linux, what remains
The installer is still the script in /opt/zimbra, user zimbra, zmcontrol. Ubuntu 22.04/24.04 and RHEL/Rocky 8/9 are in the official 10.1 table. You build Open Source Edition; Network downloads from the portal with a key. Don't mix 2017 FOSS with a 2026 Network patch.
su - zimbra -c 'zmcontrol status'
su - zimbra -c 'zmcontrol -v'
The underlying MTA remains Postfix — the foundation of ISPConfig and the email course. Zimbra is the Exchange-like layer on top; it doesn't replace Dovecot+Roundcube for anyone wanting only lean IMAP.
Timeline
- 1999 — Satish Dharmaraj, Ross Dargahi and Roland Schemers work on unified messaging at Onebox.
- 2003 — LiquidSys is born in San Mateo (California).
- 26/07/2005 — the company becomes Zimbra, named after I Zimbra, by Talking Heads.
- 04/10/2005 — Zimbra Collaboration Suite is introduced in beta at the Web 2.0 Conference.
- Feb/2006 — 3.0 GA: group calendars, Zimlets, REST, Exchange migration.
- Aug/2006 — 4.0 brings Zimbra Documents, a text and spreadsheet editor in the browser.
- 17/09/2007 — Yahoo buys Zimbra for US$ 350 million; the license becomes Yahoo Public License.
- 12/01/2010 — VMware buys Zimbra from Yahoo, targeting Exchange.
- Jul/2013 — Telligent Systems buys it from VMware; in September it becomes Zimbra, Inc. again.
- 2014 — 8.5 opens the backend under GPL-2 and frontend under CPAL-1, and replaces MySQL with MariaDB.
- 18/08/2015 — Synacor announces the acquisition. It remains the owner today.
- 22/07/2019 — 8.8.15 Joule GA, the LTS installed all over Brazil.
- 07/04/2020 — 9 Kepler GA.
- 08/03/2023 — 10 Daffodil GA, absorbing Zextras' NG modules into the core.
- 16/07/2024 — 10.1 changes licensing: official binaries require a key, even for trials.
- 27/01/2025 — the fix for CVE-2025-27915 is released in versions 9.0.0 P44, 10.0.13 and 10.1.5.
- 30/09/2025 — StrikeReady Labs reports the flaw's use as a zero-day against Brazil's Armed Forces.
- 2026 — the current series is 10.1 (patch 10.1.21); General Support for 10.1.x until 31/12/2027.
Wrap-up
Three Onebox engineers, a Talking Heads name, a Yahoo check, four owners. The Ajax of 2005 is still in the browser. The free binary isn't. Anyone wanting full Linux groupware in 2026 talks Daffodil 10.1.21 and reads release notes — not the 8.7 tarball this blog taught in 2017.
Site: zimbra.com · lifecycle: product lifecycle · source: github.com/Zimbra/zm-build · 10.1.21: releases/tag/10.1.21.