Synacor Zimbra Collaboration Suite
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox ite…
At a glance
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers.
Briefing
- Do not treat uncorroborated claims as confirmed breaches.
Questions to ask IT
- Are we affected by CVE-2026-10631, CVE-2026-50055 or 3 more, and which of our systems would be?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-10631- 6.5 · MediumExploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Not listed
- ~0.3% estimated chance of attack in 30 days
- 10.1.19 and earlier
- Not linked from the CVE record
These facts are for CVE-2026-10631. This event covers 4 more CVEs, each with its own record.
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- An enterprise mail server authenticates users, stores private communications, delivers recovery links, runs calendars, and sends mail that employees and other systems trust. Compromising it can therefore expose both email and the identities and workflows built around it.
Pulse
Last checked 30 Oct · Recheck overdue since 31 Oct 2026, 11:34 UK time · 1 quiet check collapsed
- Story14 Oct 2026, 17:08 UK time · 14 Oct
Linked reporting from Rapid7 Blog (research).
Read source (Rapid7 Blog) - Signal30 Oct 2026, 11:34 UK time · 30 Oct
in the next 30 days first recorded at 0.4% (lower likelihood signal, not confirmed exploitation).
2 entries so far. The timeline chart appears once this story has more history.
Sources
- Rapid7 BlogResearcher
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
An authorisation bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox ite…
- ProbableSummary fact75% confidence
An enterprise mail server authenticates users, stores private communications, delivers recovery links, runs calendars, and sends mail that employees and other systems trust. Compromising it can therefore expose both email and the identities and workflows built around it.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-10631
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-50055
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-73571
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-93635
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-93637