Zimbra Collaboration Suite CVE-2026-93635

Exploitation of the unauthenticated password-oracle path requires the target Zimbra domain to be configured for external LDAP 'search-filter authentication' AND to use 'lazy provisioning' - this is the exact enabling condition stated in the description and is a significant non-default limiter; domains using local or bind-based auth are not exposed to the oracle. A secondary path (returning certificates and identity data for unintended directory entries via S/MIME lookups) requires an authenticated session. Limiting factors: dependency on the specific external-directory auth/provisioning configuration, confinement to directory metadata and password-confirmation disclosure (no code execution, no write access), and the authenticated requirement for the S/MIME certificate-disclosure variant.

This is a moderate-severity information-disclosure flaw whose real-world priority is bounded well below its network-exploitable profile. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) confirms a remotely reachable, unauthenticated, low-complexity vector with only limited confidentiality impact and no integrity or availability impact, consistent with CWE-90 (LDAP injection) used as a password/identity oracle rather than for code execution or takeover. No EPSS score, no CISA KEV listing, and no explicit POC flag are present in the input, so exploitation-probability and active-exploitation signals are UNKNOWN - the only exploitation-adjacent signal is a Rapid7 research blog, which indicates researcher attention but is not confirmed weaponized exploit code. A key tension: the headline password-oracle impact is conditional ('on domains using search-filter authentication and lazy provisioning'), meaning the AC:L/PR:N vector overstates practical reach - many deployments will not use that exact configuration, making this closer to a config-dependent, targeted issue than a universally exploitable one. No SSVC decision data was supplied. Net: a legitimate patch-in-normal-cycle finding for Zimbra operators using the affected auth mode, not an emergency.

An unauthenticated remote attacker submits input that is interpolated into an external LDAP search filter against a Zimbra domain configured for search-filter authentication with lazy provisioning, then observes authentication-response differences to confirm or deny directory account attributes and passwords (a password oracle). The Rapid7 research blog describes the technique, but no confirmed public exploit tool is identified in the provided data. Given AV:N/AC:L, the requests are simple network interactions, though success depends on the target domain's specific auth configuration.