CVE-2026-93637

CVSS 3.7 (low) · published 2026-10-14

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.

Weakness: CWE-307

Source: NVD CVE-2026-93637

References

• https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.