CVE-2026-93637: CWE-307 Improper restriction of excessive authentication attempts in Zimbra Zimbra Collaboration Suite

This vulnerability involves an improper restriction of excessive authentication attempts (CWE-307) in Zimbra Collaboration Suite versions 0 through 10.1.21. Attackers can bypass the rate-limiting mechanism by using GraphQL aliases to bundle multiple authentication attempts in one HTTP request. This prevents the source-IP failure counter from incrementing, potentially allowing repeated password guessing attempts without triggering lockout or throttling mechanisms.

The impact is limited to allowing unauthenticated attackers to perform more password guesses than intended by the rate-limiting controls. The CVSS score of 3.7 indicates a low severity with low confidentiality impact and no integrity or availability impact. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. In the meantime, consider additional protective measures such as network-level rate limiting or Web Application Firewall (WAF) rules to mitigate excessive authentication attempts via GraphQL endpoints.