CVE-2026-93643: Zimbra OnlyOffice Unauthenticated Path Traversal RCE as Zimbra User TheHackerWire / 1d Telemetry Metric Intelligence Detail CVE Identifier CVE-2026-93643 CVSS Severity 9.8 CRITICAL Affected Target See technical breakdown Vulnerability Class Security Vulnerability Exploit Availability No Public PoC Indexed EPSS Threat Score Awaiting scoring CISA KEV Status Not Listed in CISA KEV Remediation Status Advisory / Mitigation In Review CVE-2026-93643 exposes OnlyOffice/Document Editing w

No standalone public exploit has been published in open research repositories at the time of writing. Our threat intelligence pipeline monitors GitHub, Exploit-DB, and Nuclei feeds continuously. Verified PoCs will be automatically integrated here upon discovery.

CVE-2026-93643 exposes OnlyOffice/Document Editing within Zimbra to critical unauthenticated remote command execution. An attacker can leverage unsigned save fields to perform path-traversal writes, culminating in arbitrary command execution under the privileges of the zimbra user account.

Vulnerability Root Cause & Flaw Mechanism

The vulnerability, CVE-2026-93643, stems from insufficient input validation and signature enforcement within the OnlyOffice/Document Editing component when integrated with Zimbra. Specifically, the flaw resides in the handling of “unsigned save fields.” An unauthenticated remote attacker can manipulate these fields when interacting with an existing, supported public Briefcase document. This manipulation allows for path-traversal sequences (e.g., ../ ) to be injected into file write operations, enabling the attacker to write arbitrary files to arbitrary locations on the filesystem, bypassing intended directory restrictions. The advisory confirms that these path-traversal writes can be leveraged to execute commands as the zimbra user. The precise mechanism by which path-traversal writes escalate to command execution (e.g., writing to a web-accessible script, cron job, or configuration file that is subsequently processed) is not explicitly detailed in the advisory and requires deep-dive analysis during exploit development or verification.

Attack Prerequisites & Threat Vector

Successful exploitation of CVE-2026-93643 requires several operational conditions. The primary prerequisite is the availability and active integration of OnlyOffice/Document Editing within the Zimbra environment. Furthermore, the attacker must have network access to the vulnerable Zimbra instance and, crucially, access to an existing supported public Briefcase document . This implies the attacker needs to either discover or create such a document. The attack is entirely unauthenticated, meaning no prior credentials or session tokens are required. The end-to-end attack progression involves an unauthenticated remote attacker sending crafted requests to the OnlyOffice/Document Editing interface, abusing the unsigned save fields. These requests contain path-traversal sequences, directing file writes outside the intended document storage directories. Once arbitrary file write is achieved, the attacker can then leverage this primitive to achieve command execution as the zimbra user, potentially by writing a malicious script or configuration that is later executed by a privileged process.

Detection, Log Analysis & Threat Hunting

Security analysts should focus on web server access logs, Zimbra application logs, and filesystem activity for anomalous patterns. Look for HTTP requests targeting OnlyOffice/Document Editing endpoints that contain path-traversal sequences (e.g., %2e%2e%2f , ../ ) within parameters related to file saving or document manipulation. Monitor for unexpected file creations or modifications outside standard document storage paths, particularly within critical system directories or web server roots, by the zimbra user. Syslog or audit logs should be scrutinized for new processes spawned by the zimbra user that are not part of normal Zimbra operations. For external threat hunting, a Shodan dork like http.title:"Zimbra Web Client" "OnlyOffice" or http.favicon.hash:-1999818868 http.html:"OnlyOffice" can help identify publicly exposed Zimbra instances with potential OnlyOffice integration, though direct confirmation of the vulnerable component requires deeper inspection.

Defensive Hardening & Mitigation

Until a vendor-supplied patch can be applied, several defense-in-depth measures are critical. Network segmentation should isolate Zimbra instances, particularly those with OnlyOffice/Document Editing exposed, from direct internet access where possible. Implement Web Application Firewall (WAF) rules to detect and block requests containing path-traversal sequences (e.g., ../ , %2e%2e%2f ) within parameters associated with file upload or save operations for OnlyOffice/Document Editing. Consider disabling the OnlyOffice/Document Editing integration if it is not business-critical, or restrict access to it via IP-based Access Control Lists (ACLs) to trusted networks only. Regularly review and audit filesystem permissions within the Zimbra environment to ensure the principle of least privilege is maintained. The vulnerability was published on September 25, 2026, indicating a patch from the vendor is expected or has been released. Organizations must prioritize applying the official vendor patch for CVE-2026-93643 immediately upon availability.

Related Vulnerabilities

CVE-2026-93642: Zimbra Modern Stored XSS via Forged Notification Leads to Mailbox Compromise

CVE-2026-93641: Zimbra Classic Unauthenticated Stored XSS Leads to Mailbox Compromise

CVE-2026-93228: Linux Kernel svcrdma Vulnerability: Malformed RDMA Chunks Lead to Critical System Instability

TheHackerWire Threat Intel Team