Critical vulnerability affecting Zimbra
A critical vulnerability affecting Zimbra would allow an unauthenticated malicious actor to execute arbitrary commands remotely on affected systems.
Description
Technical context and vulnerability details
Zimbra is an email solution and collaboration platform that allows you to manage emails, calendars and contacts. This product is affected by a vulnerability labeled CVE-2026-93643 which results from the abuse of unsigned backing fields to perform path traversal writes. Exploitation of this vulnerability would allow an unauthenticated attacker with access to a supported public Briefcase document to perform path traversal writes and execute commands as the zimbra user. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Breach of confidentiality and availability of data;
Affected systems
Products, components and targeted versions
- All Zimbra versions with OnlyOffice/Document Editing enabled;
- Zimbra Collaboration Suite (ZCS) versions 10.1 prior to 10.1.21;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Disable OnlyOffice/Document Editing if not in use;
- Update Zimbra to version 10.1.21 or the latest stable version available;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.