Is CVE-2026-93636 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93636 being exploited in the wild.

How severe is CVE-2026-93636?

Medium severity, with a CVSS score of 4.3, published 23 October 2026.

Which products and versions are affected?

Zimbra Collaboration Suite 10.1.16, 10.1.21.

Is there a fix for CVE-2026-93636?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93636 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-93636?

Check whether you run Zimbra Collaboration Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93636: Zimbra Collaboration Suite LDAP filter injection

CVE-2026-93636 · Severity: medium · CVSS 4.3 · Published 2026-10-23

Zimbra Collaboration Suite is an email and collaboration platform that manages calendars, contacts, and file sharing for organizations. An authenticated user can exploit an LDAP filter injection flaw in calendar resource search to recover sensitive system attributes like mailbox hostnames and mail routing information that should not be visible. While the attack is restricted to calendar resources, the disclosed information could aid further attacks on the infrastructure.

Technologies: Zimbra Collaboration Suite. Vendors: Zimbra.

Quick answers

Is CVE-2026-93636 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93636 being exploited in the wild.
How severe is CVE-2026-93636?: Medium severity, with a CVSS score of 4.3, published 23 October 2026.
Which products and versions are affected?: Zimbra Collaboration Suite 10.1.16, 10.1.21.
Is there a fix for CVE-2026-93636?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93636 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-93636?: Check whether you run Zimbra Collaboration Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An LDAP filter injection vulnerability in SearchCalendarResourcesRequest allows authenticated users to inject LDAP filter conditions by manipulating attribute names in search parameters. Although Zimbra escapes search values, it fails to validate attribute names before inserting them into LDAP filter expressions. Attackers can use repeated queries to extract readable resource attributes; the vulnerability is bounded by the service account's access control and the calendar-resource object scope.

Affected products

Zimbra Collaboration Suite 10.1.16, 10.1.21

Timeline

2026-10-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.