CVE-2026-93643
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.
- Published Sep 25, 2026
- CVSS 9.8 critical
- 1.0% chance of exploitation in the next 30 days (EPSS)