CVE-2026-93637: falha de baixa gravidade em Zimbra Collaboration Suite
Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
Publicada em
5Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.7
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Zimbra · Zimbra Collaboration SuiteCVEs relacionadas — Zimbra Collaboration Suite
No mesmo produto, das mais perigosas para as menos.
CVE-2026-50055MEDIUMZimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable ExpansionEPSS 0.3%CVE-2026-10631MEDIUMZimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item IdentifierEPSS 0.2%CVE-2026-50054HIGHZimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation RightEPSS 0.2%CVE-2026-93635MEDIUMZimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template SubstitutionEPSS —