CVE-2026-73575
Quick assessment
Affected
Zimbra Collaboration
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Zimbra Collaboration（ZCS）10.1.17 版本之前，Zimbra Collaboration（ZCS）的 Exchange Web Services（EWS）端点存在跨站请求伪造（CSRF）漏洞，该漏洞是由于对请求内容类型验证不足所致。攻击者可以通过诱导已认证用户提交构造的请求来利用此漏洞，从而可能在受害者不知情的情况下执行未授权操作。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Zimbra | Collaboration | < 10.1.17 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73575
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions to be performed on behalf of the victim.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Zimbra | Collaboration | 0 ~ 10.1.17 | - |
|
II. Public POCs for CVE-2026-73575
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73575
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-73575 (1)
Same Patch Batch · Zimbra · 2026-08-13 · 7 CVEs total
| CVE-2026-73570 | 8.9 HIGH | Zimbra Collaboration 命令注入漏洞 |
| CVE-2026-73576 | 6.3 MEDIUM | Zimbra <10.1.17 OnlyOffice弱密钥生成致JWT伪造 |
| CVE-2026-73572 | 6.1 MEDIUM | Zimbra <10.1.17 存储型XSS漏洞 |
| CVE-2026-73573 | 3.1 LOW | Zimbra Collaboration <10.1.17 路径穿越漏洞 |
| CVE-2026-73571 | 3.1 LOW | Zimbra Collaboration <10.1.17 授权绕过漏洞 |
| CVE-2026-73574 | 3.1 LOW | Zimbra<10.1.17经典Web客户端LFI漏洞 |
IV. Related Vulnerabilities
Same vendor: Zimbra
-
CVE-2026-93647
Zimbra Collaboration Suite Classic Web Client Stored Cross-S -
CVE-2026-93643
Zimbra Collaboration Suite OnlyOffice Integration Path Trave -
CVE-2026-93642
Zimbra Collaboration Suite Modern Web Client Stored Cross-Si -
CVE-2026-93641
Zimbra Collaboration Suite Classic Web Client Stored Cross-S -
CVE-2026-73576
Zimbra <10.1.17 OnlyOffice弱密钥生成致JWT伪造
Same weakness: CWE-352
-
CVE-2026-56662
GetSimple CMS: Missing CSRF protection in UpdateCE allows fo -
CVE-2026-56660
GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction -
CVE-2026-104059
Lektor 3.3.14 CSRF via Admin API Endpoints -
CVE-2026-103067
WordPress Memberful - Membership Plugin plugin <= 1.81.0 - C -
CVE-2026-94220
Apache APISIX: session fixation issue in feishu-auth and din
V. Comments for CVE-2026-73575
No comments yet