PT-2026-26613 · Zimbra · Zimbra Collaboration

Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-33369

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 10.0 and 10.1

Description Zimbra Collaboration (ZCS) contains an LDAP injection flaw in the Mailbox SOAP service during a FolderAction operation. The application does not adequately sanitize user-provided input before using it in an LDAP search filter. An authenticated attacker can exploit this by sending a specially crafted SOAP request to manipulate the LDAP query, potentially gaining access to sensitive directory attributes.

Recommendations Versions prior to 10.0 and 10.1 are not affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-33369

Affected Products

Zimbra Collaboration

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-33369 · Security Note
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://twitter.com/CVEnew/status/2035627037319160100 · Twitter Post
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Note
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_Fixes · Note