CVE-2026-93637: low-severity vulnerability in Zimbra Collaboration Suite
Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
Published
5Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.7
exploitation probability
—
observed exploitation
nono source reports it
An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Zimbra · Zimbra Collaboration SuiteRelated CVEs — Zimbra Collaboration Suite
In the same product, most dangerous first.
CVE-2026-50055MEDIUMZimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable ExpansionEPSS 0.3%CVE-2026-10631MEDIUMZimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item IdentifierEPSS 0.2%CVE-2026-50054HIGHZimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation RightEPSS 0.2%CVE-2026-93635MEDIUMZimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template SubstitutionEPSS —