CVE-2026-93635— Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
Quick assessment
Affected
Zimbra Zimbra Collaboration Suite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Zimbra Collaboration Suite 10.1.0 至 10.1.21 版本中存在 LDAP 过滤器注入漏洞，允许未经身份验证的攻击者篡改外部 LDAP 搜索过滤器。在启用“search-filter 认证”和“延迟配置（lazy provisioning）”的域中，此漏洞会为外部目录用户创建密码预言机（password oracle）。此外，经过身份验证的 S/MIME 查询可能返回非预期目录条目的证书和身份信息。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Zimbra | Zimbra Collaboration Suite | ≤ 10.1.21 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93635
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
Source: CVE Program / CVE List V5
Vulnerability Description
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Zimbra | Zimbra Collaboration Suite | 0 ~ 10.1.21 | - |
|
II. Public POCs for CVE-2026-93635
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93635
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-93635 (1)
-
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1) third-party-advisory
IV. Related Vulnerabilities
Same product: Zimbra Collaboration Suite
-
CVE-2026-93637
Zimbra Collaboration Suite GraphQL Batched Authentication By -
CVE-2026-50055
Zimbra Collaboration Suite Sieve Notify Filter Action Bypass -
CVE-2026-50054
Zimbra Collaboration Suite GrantRightsRequest SOAP Handler A -
CVE-2026-10631
Zimbra Collaboration Suite EWS Extension Authorization Bypas
Same vendor: Zimbra
-
CVE-2026-93637
Zimbra Collaboration Suite GraphQL Batched Authentication By -
CVE-2026-50055
Zimbra Collaboration Suite Sieve Notify Filter Action Bypass -
CVE-2026-50054
Zimbra Collaboration Suite GrantRightsRequest SOAP Handler A -
CVE-2026-10631
Zimbra Collaboration Suite EWS Extension Authorization Bypas -
CVE-2026-93647
Zimbra Collaboration Suite Classic Web Client Stored Cross-S
Same weakness: CWE-90
-
CVE-2026-89071
MOVEit Transfer LDAP injection in certificate-based authenti -
CVE-2026-110256
Dockhand before 1.0.19 Username Enumeration via LDAP Injecti -
CVE-2026-10759
BUG-000171040 Portal for ArcGIS has a security vulnerability -
CVE-2025-71431
Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoin -
CVE-2026-109357
LibreNMS before 26.9.0 LDAP Filter Injection Authentication
V. Comments for CVE-2026-93635
No comments yet