CVE-2026-93631 Zimbra CVE debrief

Who should care

Defenders responsible for Zimbra Collaboration Suite instances, especially those with the OAuth extension configured, should assess exposure and prioritize remediation. This includes operators managing Zimbra deployments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response.

Why it matters

Defenders should prioritize verifying and remediating affected Zimbra Collaboration Suite instances, especially those with the OAuth extension configured, to prevent account linking and potential unauthorized access to victim's mailbox and contacts.

• Account linking could lead to unauthorized access to victim's mailbox and contacts.
• Bidirectional CalDAV synchronization may disclose appointments to the attacker.
• Defenders should verify affected versions and assess exposure to prevent account linking.
• Remediation priority is high due to the potential for unauthorized access and data disclosure.

Technical summary

The vulnerability allows an attacker to link an attacker-controlled external account to a victim's mailbox by inducing a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This occurs because the OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can create a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the

Defensive priority

Defenders should prioritize verifying and remediating affected Zimbra Collaboration Suite instances, especially those with the OAuth extension configured.

Recommended defensive actions

• Verify Zimbra Collaboration Suite instances for affected versions (10.1.16 and 10.1.20) and assess exposure.
• Review OAuth extension configuration and consider disabling or restricting its use.
• Monitor for suspicious activity and implement compensating controls to prevent account linking.
• Apply vendor-provided patches or updates when available.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. The source item and supplemental sources offer additional context. Affected Zimbra Collaboration Suite instances, especially those with the OAuth extension configured, require verification and remediation to prevent account linking and potential unauthorized access. Defenders should verify affected versions (10.1.16 and 10.1.20) and assess exposure to prevent account linking. The CVE Program and NVD provide official details, while

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.