What about 8.6?

Hello. It's not a problem with Zimbra at all. Take a closed look at the spams (the headers) and you'll see they are not coming from your server but from the internet, with a "fake" sender (sender = recipient). In the last weeks/months, I've seen more and more of these spams. Everybody is i...

Patch will be delivered (with a few backported bugs).
No ETA yet.

Last news from support: "It is unlikely that the vulnerability will be fixed in ZCS 8.6 given the version is reaching end of support soon" and "We are going to report this request to our development team. We will let you know about the status as we hear from the development team. &quo...

Actually, "AD auth" is a pre-configured "LDAP auth" (with the good filter).

Look here: viewtopic.php?t=61347

Vulnerability has been confirmed by support. Initial answer: "This vulnerability is fixed in ZCS 8.7.11 patch 1, 8.8.7 and 8.8.8 versions. ZCS 8.6.x is reaching end of support (...). Hence, we recommend you to upgrade the server as early as possible to a later release where the vulnerability ha...

As the bug is (once again) private (even when logged in bugzilla), I created a support case.

Official announcement: viewtopic.php?f=8&t=63913

The fix is part of 8.8.7 and 8.7.11-P1.
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P1

What about 8.6-P9, not vulnerable or not fixed?
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.6.0/P9