CVE-2026-93627: medium-severity vulnerability in Zimbra Collaboration Suite
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. An attacker who knows the meeting UID and organizer address can supply a non-outdated sequence number to move the recipient's meeting to Trash or replace its details. Processing occurs automatically during email delivery without recipient interaction. ZCS 10.1.16 and 10.1.21 are affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Zimbra · Zimbra Collaboration SuiteRelated CVEs — Zimbra Collaboration Suite
In the same product, most dangerous first.
CVE-2026-115785MEDIUMZimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email AddressEPSS 0.7%CVE-2026-115786MEDIUMZimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota ExhaustionEPSS 0.4%CVE-2026-93639HIGHZimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege EscalationEPSS 0.4%CVE-2026-50055MEDIUMZimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable ExpansionEPSS 0.4%CVE-2026-50056HIGHZimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument InjectionEPSS 0.3%CVE-2026-93636MEDIUMZimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute NameEPSS 0.3%