CVE-2026-93637
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter.
Risk Assessment
An attacker may conduct a brute-force attack on passwords, potentially leading to account takeover.
Recommendation
Update Zimbra Collaboration Suite to a version later than 10.1.21 once a fix is available, and implement additional login attempt throttling mechanisms.
Other vulnerabilities in Zimbra Collaboration Suite
See all- CVE-2022-37042CriticalActively exploited
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
- CVE-2022-27925HighActively exploited
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
- CVE-2022-24682MediumActively exploited
The Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 allows an attacker to place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
- CVE-2019-9621HighActively exploited
An SSRF vulnerability in the ProxyServlet component of Zimbra Collaboration Suite. It allows an attacker to send requests from the server to internal resources.
- CVE-2018-6882MediumActively exploited
A cross-site scripting (XSS) vulnerability in ZmMailMsgView.getAttachmentLinkHtml in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7. Remote attackers can inject arbitrary web script or HTML via a Content-Location header in an email attachment.
- CVE-2026-93635Medium
An LDAP filter injection vulnerability in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.
- CVE-2026-50055Medium
A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.
- CVE-2026-50054High
An authorization flaw in Zimbra Collaboration Suite's GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.
- CVE-2026-10631Medium
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.
Original NVD description (English source)
An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS