CVE-2026-73575 Zimbra CVE debrief

Who should care

Organizations using Zimbra Collaboration (ZCS) versions prior to 10.1.17 should be aware of this CSRF vulnerability in the Exchange Web Services (EWS) endpoint and take steps to mitigate the risk.

Technical summary

The CVE-2026-73575 vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) before version 10.1.17. The vulnerability is caused by insufficient validation of request content types, allowing an attacker to perform Cross-Site Request Forgery (CSRF) attacks. An attacker can exploit this vulnerability by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions to be performed on behalf of the victim.

Defensive priority

Organizations using Zimbra Collaboration (ZCS) should prioritize patching to prevent potential unauthorized actions.

Recommended defensive actions

• Apply patches or updates to Zimbra Collaboration (ZCS) to version 10.1.17 or later
• Implement additional security measures to monitor and restrict EWS endpoint requests
• Educate users about the risks of CSRF attacks and the importance of verifying request authenticity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-73575 record indicates a Cross-Site Request Forgery (CSRF) vulnerability in Zimbra Collaboration (ZCS) before 10.1.17, specifically in the Exchange Web Services (EWS) endpoint, due to insufficient validation of request content types. An attacker could exploit this by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions on behalf of the victim. However, detailed information about affected configurations and vendor remediation is limited in the provided source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.