What’s Vulnerable › Vulnerabilities

CVE-2026-93637: Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-16
• Weakness: CWE-307

Description

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.

Affected products

• Zimbra Collaboration: through 10.1.21

In the news

• From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

References

• https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1

Get alerted when CVE-2026-93637 or the next vulnerability affects your stack