CVE-2026-73575CWE-352csrf

CVE-2026-73575

Low · published August 13, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions to be performed on behalf of the victim.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00154 · 4.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-13T20:19Z
Affected products (1)
ProductVersionsFixed in
synacor/zimbra_collaboration_suite< 10.1.1710.1.17
References (2)
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · [email protected]https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · [email protected]
EPSS history
Timeline
  • 13 AUG 15:24Z
    In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra…
    cvelistv5