Type Vulnerability
An enterprise mail server authenticates users, stores private communications, delivers recovery links, runs calendars, and sends mail that employees and other systems trust.
Rapid7
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox ite…
CVE-2026-93635
What this means
This is rated medium severity (5.3 out of 10). There is no confirmed exploitation of it yet.
Full vendor description
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.
Scoring and exploitation
5.3/ 10
CVSS 3.1 base scoreMedium
Exploitable over the network without any account, and no one has to click or open anything. Low impact on confidentiality.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityLowC:L
IntegrityNoneI:N
AvailabilityNoneA:N
- Not reported
- Exploited in the wild
- Not confirmed in the
- Not reported
Weaknesses
CWE-90
References
1 link from the CVE record, grouped by site.