PT-2026-26615 · Zimbra · Zimbra Exchange Web Services+1

CVE-2026-33371 · Publicado 2026-02-04 · Atualizado 2026-03-22

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration versions 10.0 through 10.1

Description An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacker can submit crafted XML data that is processed by an XML parser with external entity resolution enabled. Successful exploitation may allow disclosure of sensitive local files from the server. The vulnerability occurs when processing XML data through the SOAP interface.

Recommendations Versions prior to 10.0 and versions after 10.1 are not affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2026-07903

CVE-2026-33371

Produtos afetados

Zimbra Collaboration

Zimbra Exchange Web Services

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33371.json · Exploit
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-07903 · Nota de Segurança
• https://wiki.zimbra.com/wiki/Security_Center · Aviso do Fabricante
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_Fixes · Nota
• https://twitter.com/CVEnew/status/2035627039017803955 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33371 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33371 · Nota de Segurança
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Nota