Description
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.
Published: 2026-10-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Credential extraction and identity data disclosure
Action: Apply Patch
AI Analysis

Impact

LDAP filter injection allows an unauthenticated attacker to modify external LDAP search filters within Zimbra Collaboration Suite. This injection can turn the system into a password oracle for users tied to external directories and, for authenticated S\/MIME lookups, expose certificates and identity data for directory entries the attacker should not see.

Affected Systems

The vulnerability is present in Zimbra Collaboration Suite versions 10.1.0 through 10.1.21. All instances of these product versions, regardless of configuration, are potentially affected.

Risk and Exploitability

The vulnerability scores 5.3 on the CVSS scale, indicating moderate severity. The EPSS score is <1%, indicating a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending crafted LDAP queries; no special privileges or user interaction are required, making the risk higher in environments that use search-filter authentication or lazy provisioning.

Generated by OpenCVE AI on October 15, 2026 at 18:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Zimbra Collaboration Suite to version 10.1.22 or later, which removes the vulnerable computeDn() template handling.
  • If an upgrade is delayed, reconfigure the installation to disable search-filter authentication and lazy provisioning to eliminate the password oracle surface.
  • Implement or enforce strict input validation for LDAP filters, escaping all special characters and restricting the use of computeDn() templates to non-privileged contexts.

Generated by OpenCVE AI on October 15, 2026 at 18:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Zimbra
Zimbra zimbra Collaboration Suite
Vendors & Products Zimbra
Zimbra zimbra Collaboration Suite

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.
Title Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
Weaknesses CWE-90
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Zimbra Zimbra Collaboration Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: rapid7

Published:

Updated: 2026-10-16T15:31:51.597Z

Reserved: 2026-09-18T12:22:34.912Z

Link: CVE-2026-93635

cve-icon Vulnrichment

Updated: 2026-10-16T15:29:27.183Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:20:21.297

Modified: 2026-10-16T19:55:59.740

Link: CVE-2026-93635

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T16:15:14Z

Weaknesses
  • CWE-90

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')