CVE-2026-93636— Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name
Quick assessment
Affected
Zimbra Zimbra Collaboration Suite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Zimbra 协作套件（ZCS）中存在 LDAP 过滤器注入漏洞，允许已认证用户通过 接口查询本不应返回的日历资源属性。Zimbra 虽然会对搜索值进行转义处理，但会将用户提供的属性名称直接插入 LDAP 过滤器表达式中，而未进行任何验证。攻击者可借此注入额外条件，并利用重复的匹配查询来恢复可读的资源属性，例如内部邮箱主机名和邮件传输路由信息。该搜索操作仍受限于日历资源对象范围以及 LDAP 服务账户的访问权限。受影响的版本为 ZCS 10.1.16 和 10.1.21。
Possible ATT&CK Techniques 2 AI
T1069 · Permission Groups Discovery T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93636
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name
Source: CVE Program / CVE List V5
Vulnerability Description
An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP filter expressions without validation. An attacker can inject additional conditions and use repeated matching queries to recover readable resource attributes such as internal mailbox hostnames and mail transport routes. The search remains restricted to calendar-resource objects and the LDAP service account's access rights. ZCS 10.1.16 and 10.1.21 are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Zimbra | Zimbra Collaboration Suite | 0 ~ 10.1.21 | - |
|
II. Public POCs for CVE-2026-93636
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93636
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-93636 (1)
-
Zimbra Security Advisories - Zimbra :: Tech Center vendor-advisory
Other References for CVE-2026-93636 (1)
Same Patch Batch · Zimbra · 2026-10-23 · 17 CVEs total
| CVE-2026-10632 | 8.7 HIGH | Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document |
| CVE-2026-50053 | 8.7 HIGH | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL P |
| CVE-2026-93639 | 8.7 HIGH | Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Admi |
| CVE-2026-93640 | 7.8 HIGH | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Conf |
| CVE-2026-50056 | 7.8 HIGH | Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injec |
| CVE-2026-50057 | 7.8 HIGH | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permis |
| CVE-2026-93631 | 7.1 HIGH | Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Link |
| CVE-2026-115786 | 6.5 MEDIUM | Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaus |
| CVE-2026-93638 | 6.1 MEDIUM | Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Pag |
| CVE-2026-93633 | 5.4 MEDIUM | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Char |
| CVE-2026-93629 | 5.3 MEDIUM | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar |
| CVE-2026-93627 | 5.3 MEDIUM | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar |
| CVE-2026-93628 | 5.3 MEDIUM | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar |
| CVE-2026-93630 | 4.3 MEDIUM | Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization |
| CVE-2026-93634 | 4.3 MEDIUM | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Recor |
| CVE-2026-115785 | 4.3 MEDIUM | Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email A |
IV. Related Vulnerabilities
Same product: Zimbra Collaboration Suite
-
CVE-2026-115786
Zimbra Collaboration Suite Shared-File Mailbox Quota Account -
CVE-2026-115785
Zimbra Collaboration Suite Data Source Test SMTP Command Inj -
CVE-2026-93640
Zimbra Collaboration Suite Local Privilege Escalation via Un -
CVE-2026-50057
Zimbra Collaboration Suite Local Privilege Escalation via Un -
CVE-2026-50056
Zimbra Collaboration Suite Local Privilege Escalation via zm
Same vendor: Zimbra
-
CVE-2026-115786
Zimbra Collaboration Suite Shared-File Mailbox Quota Account -
CVE-2026-115785
Zimbra Collaboration Suite Data Source Test SMTP Command Inj -
CVE-2026-93640
Zimbra Collaboration Suite Local Privilege Escalation via Un -
CVE-2026-50057
Zimbra Collaboration Suite Local Privilege Escalation via Un -
CVE-2026-50056
Zimbra Collaboration Suite Local Privilege Escalation via zm
Same weakness: CWE-90
-
CVE-2026-15723
Improper Neutralization of Special Elements used in an LDAP -
CVE-2026-93635
Zimbra Collaboration Suite LDAP Filter Injection via Unescap -
CVE-2026-89071
MOVEit Transfer LDAP injection in certificate-based authenti -
CVE-2026-110256
Dockhand before 1.0.19 Username Enumeration via LDAP Injecti -
CVE-2026-10759
BUG-000171040 Portal for ArcGIS has a security vulnerability
V. Comments for CVE-2026-93636
No comments yet