CVE WatchOct 16, 2026

CVE-2026-93635

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search fi

CVSS

5.3

Medium

EPSS

0.2%

p12

KEV

—

Exploit Today

0-100

Published: Oct 14, 2026 · Last modified: Oct 16, 2026 · CWE-90

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-10-152026-10-20

Technical description

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.

Official references

www.rapid7.comhttps://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-890717.5 HIG

40.6%

——12Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.3d CVE-2026-1102563.7 LOW

23.8%

——7Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.8d CVE-2026-107595.5 MED

15.0%

——4A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.5d CVE-2025-714315.3 MED

15.3%

——5Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.2d CVE-2026-1093578.1 HIG

38.5%

——12LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access.6d CVE-2026-940539.1 CRI

30.2%

——9Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication. Other Apache MINA SSHD servers are not affected. Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*". Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter parameters according to RFC 4515.22d