One compromised Zimbra account can impersonate other users and keep copying mail after a password change
Rapid7 reported more than 80 vulnerabilities in Zimbra Collaboration Suite and is releasing them in stages while fixes land on different schedules. The first five include a login-limit bypass and flaws that work from one ordinary compromised account.
The Watch · Security desk
What happened
- Parts 3 and 4 take the chain from SSRF in the document service to code execution as the zimbra user, then to several independent paths to root.
- CVE-2026-93637 lets password guesses sent through Modern's GraphQL endpoint stay out of the failed-login counter.
- Any compromised account can send mail as another local user by placing that user's address in an authenticated request.
- With EWS enabled for the compromised account, the attacker can read other users' conversations, attachments, drafts, sent mail, contacts and calendar entries.
- A separate Sieve policy bypass means the attacker keeps getting copies of new mail even once the original session has expired or the password has been changed.
Why it matters
- exposure The EWS setting on each account now decides how far one stolen password reaches into other people's mail.
- constraint Monitoring built on the source-IP failure counter or its HTTP 503 responses will not see password guessing through GraphQL.
- cost Closing out a compromised account takes more than a password change. Incident teams also have to check Sieve configuration for copies of future mail.
- decision Administrators get no single patch date. They have to track fixes component by component, and Rapid7's GitHub repository is the tracker.
Start at the login. Classic sends password attempts through the SOAP AuthRequest path, and ZimbraInvalidLoginFilter counts failures there by source address [10]. Modern exposes the same password check through a GraphQL authenticate mutation [10]. The default threshold is 10 failures within the configured window, after which the filter answers with HTTP 503 [11]. GraphQL attempts never reach that count, and getting to them takes only HTTPS access to the server [9][11].
A second pre-authentication flaw is narrower. It applies where Zimbra authenticates against external LDAP, and there it can leave the optional lockout policy with no local account to lock [8]. Outside that setup it has nothing to act on.
After login the findings stop depending on one another. Rapid7 says each remaining finding is independently exploitable from an ordinary compromised account [12]. We rank impersonation first for reach, because it needs no optional feature [13]. Zimbra submits the forged message through its trusted outbound pipeline and records a copy in the named user's Sent folder [13]. Mailbox reading is more conditional, since it needs EWS enabled for the compromised account [14]. The Sieve bypass is the persistence step [15].
This is one stage of a longer chain. Rapid7's later parts end at root [5]. A BruCON presentation, Signed, Sealed, Compromised: Weaponizing Enterprise Mail Infrastructure, previewed those chains, including root-command output returned to the victim's browser after one message selection [6]. Part 2 covers unauthenticated stored XSS in the Classic and Modern clients, where a script can install a Sieve forwarding rule (CVE-2026-50055) [4]. Rapid7 says CVE-2026-73571 makes those attacks more credible [16]. It places the message in the mailbox as any chosen local user [16].
Testing used ZCS 10.1.16_GA_4850 Network Edition on Ubuntu 22.04 [7]. The five flaws are under 6.25% of the more than 80 reported [19]. Rapid7 says its examples do not cover everything an attacker can do with authenticated access [17]. The write-ups and proofs of concept are public in a GitHub repository, and for fixed findings it keeps the vulnerable-to-fixed diff [2][18]. The opening of the post does not say which of the five are fixed or whether any are being exploited.
What to watch
- Parts 2 to 4 of the series and updates to Rapid7's GitHub tracker as fixes become public.
- Zimbra fix releases for each of the five account flaws, including CVE-2026-93637.
- Any report of in-the-wild use of the GraphQL rate-limit bypass or the Sieve persistence path.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
During a broader assessment of Zimbra Collaboration Suite, Rapid7 reported more than 80 vulnerabilities spanning authentication, mailbox authorization, calendar processing, web clients, document services, and the host operating system.
- [2]
The affected components are being fixed on different schedules, so Rapid7 is publishing the analysis in stages; an accompanying GitHub repository with full write-ups and PoCs serves as a live technical tracker, updated as further findings and fixes become public.
- [3]
The first article concentrates on five account-related vulnerabilities.
- [4]
Part 2 will cover unauthenticated stored XSS paths in the Classic and Modern clients; a script can install the Sieve forwarding rule (CVE-2026-50055), and another path preserves direct mailbox access after the original session expires or the victim changes their password.
- [5]
Parts 3 and 4 move through the document-service boundary from SSRF to code execution as zimbra, then cover multiple independent paths from zimbra to root.
- [6]
The BruCON presentation, Signed, Sealed, Compromised: Weaponizing Enterprise Mail Infrastructure, previewed these chains, including selected root-command output returned to the victim's browser after one message selection.
- [7]
Rapid7 initially assessed ZCS 10.1.16_GA_4850 Network Edition on Ubuntu 22.04.
- [8]
In the configured external-LDAP case, a second pre-authentication flaw can leave the optional account-lockout policy with no local account to lock.
- [9]
The CVE-2026-93637 pre-authentication route requires only HTTPS access to Zimbra.
- [10]
ZimbraInvalidLoginFilter normally records failed logins by source address; Classic submits login attempts through the SOAP AuthRequest path, whereas Modern exposes the same password check through its GraphQL authenticate mutation.
- [11]
The limiter's failure threshold is 10 by default, and after a source crosses it within the configured window, subsequent requests handled by the filter receive HTTP 503; CVE-2026-93637 allows attempts through GraphQL to remain invisible to that counter.
- [12]
Each remaining finding is independently exploitable from an ordinary compromised account.
- [13]
Email impersonation needs no optional feature: the attacker places a different local address in an authenticated request, and Zimbra submits the message from that account through the trusted outbound pipeline and records a copy in the selected user's Sent folder.
- [14]
If EWS is enabled for the compromised account, the attacker can read private conversations, attachments, drafts, sent mail, contacts and calendar entries from other users' mailboxes.
- [15]
A separate Sieve policy bypass can keep copies of future mail flowing to the attacker after the original session expires or the password changes.
- [16]
CVE-2026-73571 makes these attacks more credible by placing the message in the mailbox as any chosen local user.
- [17]
These examples do not represent everything an attacker can do with authenticated Zimbra access, or the full vulnerability set from the assessment.
- [18]
For fixed findings, each section describes Zimbra's fix and the accompanying GitHub repository retains the complete vulnerable-to-fixed diff.
- [19]
The five flaws covered in Part 1 are under 6.25% of the more than 80 vulnerabilities Rapid7 reported.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- blog.rapid7.comFrom One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Vulnerability DisclosureFollow
- Enterprise email securityFollow
- Authentication rate limitingFollow