Topic

Email Security

Reporting and analysis related to Email Security.

Articles: 1
Desk: 1

Data graphic: Rapid7's five Zimbra flaws chain one ordinary account into every mailbox: GraphQL password guessing CVE-2026-93637 , LDAP filter injection CVE-2026-93635 , cross-user mail reading via EWS CVE-2026-10631 , sending as another user CVE-2026-73571 and copying mail out via Sieve notify CVE-2026-50055 . Two of the five, CVE-2026-93635 and CVE-2026-93637, are unpatched; the others are fixed in ZCS 10.1.17 and 10.1.20. PoCs are public for all five, per Rapid7.

highExploits Email Security

Rapid7 publishes five Zimbra flaws with public exploit scripts; two remain unpatched

Rapid7's Zimbra research breaks the account boundary: cross-user mail reads, send-as and forwarding bypass, with public PoCs. Two flaws have no fix yet.

Oct 18 · 5 min