UpHeron
All vulnerabilities

Servers and applications

CVE-2026-93636

An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP filter expressions without validation. An attacker can inject additional conditions and use repeated…

Severity
Medium 4.3
Published
23 Oct 2026
Last changed
28 Oct 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
  • Every version up to 10.1.21

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-93636
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-93636