CVE-2026-93643: Zimbra Collaboration Suite ZCS

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.

Affected products

• Zimbra Zimbra Collaboration Suite ZCS: before 10.1.21 (fixed in 10.1.21)

Published 2026-09-25. Last modified 2026-09-29.