![\"Mascote](\"\/wp-content\/uploads\/2026\/09\/zimbra-historia-v2.webp\")
<\/p>\n<\/p>\n
Zimbra is the Ajax groupware that wanted to be Linux's Exchange. Born as LiquidSys in 2003, it became Zimbra Inc. on 26 July 2005, and its name came from the song I Zimbra<\/em> by Talking Heads. In September 2007 Yahoo bought it for US$ 350 million. Then: VMware, Telligent, Synacor. On 31 August 2026 the stable series is 10.1.21<\/strong> (Daffodil). The server is still Postfix + Java + OpenLDAP \u2014 the same combination as in 2005, with different owners.<\/p>\n <\/p>\n Satish Dharmaraj (CEO), Ross Dargahi (engineering) and Roland Schemers (technology) had worked on unified messaging at Onebox in 1999. In 2003 they founded LiquidSys in San Mateo. The thesis, in the 2007 podcast with Read\/WriteWeb: people spend more time in email than in search or the browser. Gmail was a year old. The message was Ajax pushed to the limit \u2014 tooltips, dragging, right-click menus \u2014 on a server the admin installed on Linux, not in a Google datacenter.<\/p>\n On 26 July 2005 the company became Zimbra. Scott Dietzen, later president and CTO, explained on the blog: the name comes from I Zimbra<\/em>, Talking Heads, 1979. On 12 September LWN reported the open source beta. On 4 October, at the Web 2.0 Conference, the official press release: Zimbra Collaboration Suite in beta, GA expected in November. Funding: Accel, Benchmark, Redpoint and Eric Hahn (former Netscape CTO), around US$ 16 million in Series A and B.<\/p>\n General availability arrived on 7\u20138 February 2006<\/strong>, as ZCS 3.0: group calendars, Zimlets (Wikipedia, search, Amazon), REST, PST import, Exchange migration. Platforms: Fedora, RHEL 4, SUSE, Debian, Mac OS X. In August 2006 version 4.0 brought Zimbra Documents (text and spreadsheets in the browser, ALE \u2014 Ajax Linking and Embedding).<\/p>\n The server was never \u201cjust another webmail\u201d. It's a collaboration appliance: Postfix MTA, OpenLDAP directory, database (MySQL, then MariaDB in 8.5), Lucene search, Jetty (from 5 onward; previously Tomcat), nginx in front (since 5.0), ClamAV + SpamAssassin + Amavis, OpenDKIM since 8. SOAP in the API, IMAP and POP3 for thin clients. CalDAV, CardDAV, S\/MIME. The thick client is Ajax on the web; Outlook and ActiveSync stayed on the paid side for years.<\/p>\n Two editions from the start: Open Source Edition<\/strong> (free, initially MPL\/ZPL) and Network Edition<\/strong> (EULA, MAPI connector, native sync). The 2005 price: US$ 28 per mailbox\/year on Network.<\/p>\n On 17 September 2007<\/strong> Yahoo bought Zimbra. Two years from the Web 2.0 launch to the check. The source license became Yahoo Public License. The code disappeared from SourceForge; downloads continued on the website. Yahoo's idea was groupware for the hosting business. Google took the consumer market. In 2010 Yahoo \u201cshed non-core assets\u201d.<\/p>\n On 12 January 2010<\/strong> VMware bought Zimbra from Yahoo. Ashlee Vance in the Times: a jab at Microsoft Exchange. 7.0 dropped Mac OS X Server. Kevin Henrikson later described both integrations as disasters: at Yahoo the startup ignored the buyer; at VMware vSphere printed money and the US$ 50 million email business was irrelevant.<\/p>\n In July 2013 Telligent Systems bought it from VMware and in September became Zimbra, Inc. again. On 18 August 2015<\/strong> Synacor (Buffalo, NY) announced the acquisition. It remains the owner today. In 2019 the product dropped \u201cSuite\u201d and became simply Zimbra Collaboration<\/strong>.<\/p>\n Desktop \u2014 the free native client \u2014 stopped under VMware in 2013, returned in 2014 and died for good around 2019. 8.5 (2014) added HTML5 offline mode to the web client instead.<\/p>\n Until 8.5 the source used MPL\/ZPL\/YPL. 8.5 opened the backend under GPL-2 and the frontend under CPAL-1. The FSF considers ZPL free. Synacor's current FAQ sends another message: the product \u201cremains open source\u201d, but official binaries are no longer free to download and use<\/strong>. Network Edition requires a key; 10.1 requires a new key, even for a trial.<\/p>\n The community builds FOSS from github.com\/Zimbra\/zm-build<\/a>. There is an embargo: the wiki lists weeks between the Network patch and FOSS source. Third-party builds (Maldua and others) fill the gap. Anyone running the free tarball from 2010 discovered in the decade of 2020 that \u201copen source\u201d and \u201cofficial ISO without login\u201d aren't the same thing.<\/p>\n The scientific\/floral codenames:<\/p>\n 10 removed Zextras' NG modules (backup, HSM, ActiveSync, delegated admin) and put the functionality in the core. Upgrading from 8.8.15\/9 requires the NG migration tool. On 31 August 2026 the patch is 10.1.21<\/strong>.<\/p>\n On this blog, the 2017 howto still points to 8.7: Installing Zimbra 8.7.1 on Ubuntu<\/a> and the note on 8.7.7<\/a>. Those posts retained their identity; the 2026 series is 10.1.<\/p>\n Groupware with webmail presents an XSS and parser RCE attack surface. In 2024 CVE-2024-45519 (RCE in the CVE-2025-27915<\/strong> is a stored XSS<\/em> in the Classic Web Client: the client didn't sanitize HTML inside Eight months later, on 30 September 2025, StrikeReady Labs published that the flaw had been used as a zero-day in a campaign targeting the Brazilian Armed Forces<\/strong>, with The message is the same as with Roundcube<\/a>: an overdue webmail patch means an open inbox. And notice the interval \u2014 the fix had existed since January; those attacked were running an unpatched version. Unsupported 8.8.15 and 9 aren't nostalgia, they're holes.<\/p>\n The installer is still the script in The underlying MTA remains Postfix \u2014 the foundation of ISPConfig<\/a> and the email course<\/a>. Zimbra is the Exchange-like layer on top; it doesn't replace Dovecot+Roundcube for anyone wanting only lean IMAP.<\/p>\n Three Onebox engineers, a Talking Heads name, a Yahoo check, four owners. The Ajax of 2005 is still in the browser. The free binary isn't. Anyone wanting full Linux groupware in 2026 talks Daffodil 10.1.21 and reads release notes \u2014 not the 8.7 tarball this blog taught in 2017.<\/p>\n Site: zimbra.com<\/a> \u00b7 lifecycle: product lifecycle<\/a> \u00b7 source: github.com\/Zimbra\/zm-build<\/a> \u00b7 10.1.21: releases\/tag\/10.1.21<\/a>.<\/p>","protected":false},"excerpt":{"rendered":" Zimbra is the Ajax groupware platform that wanted to be Exchange for Linux. It began as LiquidSys in 2003, became Zimbra Inc. on July 26, 2005, and took its name from the Talking Heads song I Zimbra. In September 2007, Yahoo bought it for US$ 350 million. Then came VMware, Telligent, and Synacor. On the 31 \u2026 Read more<\/a><\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[78,2,120,69],"tags":[79,297,233,299,298,70],"class_list":["post-633","post","type-post","status-publish","format-standard","hentry","category-email","category-linux","category-servidores","category-zimbra","tag-email","tag-groupware","tag-postfix","tag-synacor","tag-yahoo","tag-zimbra"],"_links":{"self":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/633","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/comments?post=633"}],"version-history":[{"count":4,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/633\/revisions"}],"predecessor-version":[{"id":1174,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/633\/revisions\/1174"}],"wp:attachment":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/media?parent=633"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/categories?post=633"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/tags?post=633"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}LiquidSys, Onebox and Web 2.0<\/h2>\n
3.0 GA and what the server is<\/h2>\n
Yahoo, US$ 350 million<\/h2>\n
VMware, Telligent, Synacor<\/h2>\n
Licensing, FOSS and the binary that disappeared<\/h2>\n
Joule, Kepler, Daffodil<\/h2>\n
\n
The price of HTML, again<\/h2>\n
postjournal<\/code> service, which isn't enabled by default) became a case. But the episode of interest to Brazilian readers is another one.<\/p>\n.ics<\/code> calendar files. Opening the message was enough \u2014 JavaScript fired through an ontoggle<\/code> event inside a <details><\/code> tag and ran in the victim's session, able to create a filter forwarding the entire mailbox to the attacker. Zimbra fixed it on 27 January 2025<\/strong>, in versions 9.0.0 Patch 44, 10.0.13 and 10.1.5.<\/p>\n.ics<\/code> attachments sent by a sender impersonating the Libyan Navy's Protocol Office. Zimbra responded that it found no evidence of exploitation against Brazilian entities \u2014 the disagreement remains. What's undisputed: CISA added the CVE to the KEV catalog and set a remediation deadline for US federal agencies. In July 2026 another stored XSS<\/em> in the same class appeared, patched in 10.1.19<\/strong>.<\/p>\nOn Linux, what remains<\/h2>\n
\/opt\/zimbra<\/code>, user zimbra<\/code>, zmcontrol<\/code>. Ubuntu 22.04\/24.04 and RHEL\/Rocky 8\/9 are in the official 10.1 table. You build Open Source Edition; Network downloads from the portal with a key. Don't mix 2017 FOSS with a 2026 Network patch.<\/p>\nsu - zimbra -c 'zmcontrol status'\nsu - zimbra -c 'zmcontrol -v'\n<\/code><\/pre>\nTimeline<\/h2>\n
\n
Wrap-up<\/h2>\n