CVE-2026-115786 Synacor CVE debrief

Who should care

ZCS administrators and users with mailbox quota limitations should assess exposure and prioritize patching. This includes reviewing compensating controls, monitoring mailbox quota usage, and verifying affected versions. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

Authenticated users can consume another user's mailbox quota by sharing and revoking documents, affecting ZCS 10.1.16 and 10.1.20. Defenders should prioritize patching and verify mailbox quota usage.

• Potential mailbox quota exhaustion preventing incoming mail and size-increasing operations.
• Need for verification of affected versions and patch application.
• Possible impact on user interactions with shared documents.

Technical summary

The vulnerability allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document, affecting ZCS 10.1.16 and 10.1.20. This is caused by the creation of a shared-file record that charges the document size to mailbox-wide usage when shared, and the failure to reverse this charge when the document is revoked. The issue can lead to potential mailbox quota exhaustion and disruption of incoming mail and size-increasing operations. Defenders should prioritize patching and verify mailbox quota usage.

Defensive priority

Medium-priority patching and verification recommended for ZCS 10.1.16 and 10.1.20 users.

Recommended defensive actions

• Patch ZCS to a version that fixes the quota-accounting issue.
• Verify mailbox quota usage and monitor for potential abuse.
• Restrict sharing and revocation of documents to trusted users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability affects ZCS 10.1.16 and 10.1.20, confirmed via official CVE Program record and NIST NVD detail page. Evidence is limited to publicly available information and may not reflect the full scope or impact of the vulnerability. Defenders should verify mailbox quota usage and monitor for potential abuse. The CVE record was published on 2026-10-23T14:17:52.867Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.