CVE-2026-73575
Low
Description
In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions to be performed on behalf of the victim.
SeverityLow
CVSS3.1
Exploit probability—
Product
Synacor Zimbra Collaboration Suite
PublishedAug 13, 2026
First seenAug 13, 2026
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- synacor zimbra_collaboration_suite10.1.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| synacor zimbra_collaboration_suite | v < 10.1.17 | 10.1.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.