CVE-2026-73575

At a glance

Severity: LOW 3.1
EPSS: EPSS 0.15 % · percentile 4 (2026-10-27)
State: PUBLISHED
Published: 2026-08-13
Updated: 2026-08-13
Assigner: mitre
NVD status: Analyzed

Description

In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions to be performed on behalf of the victim.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	LOW 3.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N	mitre
CVSS 3.1	LOW 3.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N	NVD · cve@mitre.org (Secondary)
CVSS 3.1	LOW 3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-352

European references

ENISA EUVD · EUVD-2026-58074
GCVE · GCVE-0-2026-73575

Affected configurations (NVD CPE)

cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* < 10.1.17

Affected products

Product	Versions
Zimbra · Collaboration	affected 0 < 10.1.17

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD