Zimbra is urging Philippine organizations that manage their own email servers to fix actively exploited vulnerabilities within 24 to 72 hours, as part of a risk-based approach to email security.
The recommendation forms part of a five-step routine covering security baselines, threat monitoring, vulnerability prioritization, remediation deadlines and verification. Zimbra says setting deadlines in advance can help organizations address high-risk weaknesses before they remain exposed for too long.
Vulnerability disclosures make prioritization critical
Zimbra’s guidance cites Viettel Cyber Security data showing that 34,650 software vulnerabilities were newly disclosed worldwide in the first half of 2026, including 77 rated high impact for products and services widely used in the Philippines.
With vulnerabilities emerging across software and services, organizations need to determine which weaknesses require immediate action rather than treating every issue equally. Zimbra recommends assessing whether an affected system is accessible from the internet, whether attackers are already exploiting the vulnerability, and how sensitive or business-critical the system is.
Under its proposed approach, actively exploited vulnerabilities should be addressed within 24 to 72 hours. Lower-risk issues can follow longer remediation schedules based on their severity and the systems affected.
“No organization can fix everything at once, which means prioritization is a leadership decision as much as a technical one,” said Bret Cunningham, chief product officer at Synacor, Zimbra’s parent company.
Cunningham said organizations running their own email infrastructure have greater control over where their data resides and who manages it, but also bear responsibility for deciding which security issues to address first.
Zimbra’s five steps for email server security
Zimbra’s proposed routine begins with establishing a secure baseline for email infrastructure. This includes running supported software versions, disabling unused software, encrypting connections and restricting administrator access to designated individuals.
The second step is monitoring new threats. Zimbra recommends assigning responsibility for tracking vendor security advisories, national cybersecurity agency alerts and vulnerabilities known to be actively exploited. Teams should also compare these warnings against internal system logs to identify potentially affected systems.
Third, organizations should rank vulnerabilities according to external accessibility, exploitation status and the sensitivity and business importance of the affected systems. Those rankings then inform the fourth step: setting remediation deadlines before an active threat forces teams to make decisions under pressure.
The final step is verification. After applying a fix, teams should confirm that the remediation succeeded and check for signs that attackers may have exploited the vulnerability before it was addressed.
Patching is only part of resilience
Cunningham said patch records can show how an organization responded to known vulnerabilities, but they do not tell the whole story of its security posture.
Resilience also depends on identifying weaknesses that went undetected, understanding how far an attacker could move after gaining access, and determining how quickly an intrusion would be discovered.
For organizations operating their own email servers, Zimbra’s guidance emphasizes both timely patching and the processes needed to identify, prioritize and verify security fixes. The company’s proposed deadlines are intended to make remediation decisions clearer before an actively exploited vulnerability becomes an incident.
