CVE-2026-33371

4.3 mediumEPSS 0.2%

Medium (4.3) in synacor zimbra collaboration suite. EPSS 0.2% chance of exploitation in the next 30 days.

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacker can submit crafted XML data that is processed by an XML parser with external entity resolution enabled. Successful exploitation may allow disclosure of sensitive local files from the server.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2026-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

synacor:zimbra_collaboration_suite

References

https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Check your stack JSON