CVE-2026-73572
Quick assessment
Affected
Zimbra Collaboration
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Zimbra Collaboration（ZCS）10.1.17 之前的版本中，Zimbra 经典 Web 客户端存在一个存储型跨站脚本（XSS）漏洞。该漏洞源于对特定附件内容在Inline预览时的清理不足。攻击者可发送包含恶意附件的构造邮件，当用户预览该邮件时，会在受害者的浏览器会话中执行任意 JavaScript 代码。成功利用此漏洞后，攻击者可以代表受害者用户执行未授权操作，可能导致数据泄露或对敏感信息的未授权访问。
Possible ATT&CK Techniques 3 AI
T1213 · Data from Information Repositories T1059 · Command and Scripting Interpreter T1561 · Disk WipeAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Zimbra | Collaboration | < 10.1.17 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73572
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that, when previewed by a user, executes arbitrary JavaScript within the victim's browser session. Successful exploitation may allow an attacker to perform unauthorized actions on behalf of the victim user, potentially leading to data exfiltration or unauthorized access to sensitive information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Zimbra | Collaboration | 0 ~ 10.1.17 | - |
|
II. Public POCs for CVE-2026-73572
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73572
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-73572 (1)
Same Patch Batch · Zimbra · 2026-08-13 · 7 CVEs total
| CVE-2026-73570 | 8.9 HIGH | Zimbra Collaboration 命令注入漏洞 |
| CVE-2026-73576 | 6.3 MEDIUM | Zimbra <10.1.17 OnlyOffice弱密钥生成致JWT伪造 |
| CVE-2026-73575 | 3.1 LOW | ZCS<10.1.17 CSRF漏洞 |
| CVE-2026-73573 | 3.1 LOW | Zimbra Collaboration <10.1.17 路径穿越漏洞 |
| CVE-2026-73571 | 3.1 LOW | Zimbra Collaboration <10.1.17 授权绕过漏洞 |
| CVE-2026-73574 | 3.1 LOW | Zimbra<10.1.17经典Web客户端LFI漏洞 |
IV. Related Vulnerabilities
Same vendor: Zimbra
-
CVE-2026-93647
Zimbra Collaboration Suite Classic Web Client Stored Cross-S -
CVE-2026-93643
Zimbra Collaboration Suite OnlyOffice Integration Path Trave -
CVE-2026-93642
Zimbra Collaboration Suite Modern Web Client Stored Cross-Si -
CVE-2026-93641
Zimbra Collaboration Suite Classic Web Client Stored Cross-S -
CVE-2026-73576
Zimbra <10.1.17 OnlyOffice弱密钥生成致JWT伪造
Same weakness: CWE-79
-
CVE-2026-54049
Sakai Conversations has a Stored XSS Issue -
CVE-2026-71542
GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "ti -
CVE-2026-70650
GetSimple CMS: Authenticated Stored XSS in backup viewer (ba -
CVE-2026-55230
Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass -
CVE-2026-101890
Prime Mover < 2.2.1 Stored XSS via Package Metadata
V. Comments for CVE-2026-73572
No comments yet