PT-2026-26615 · Zimbra · Zimbra Exchange Web Services+1

Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-33371

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration versions 10.0 through 10.1

Description An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacker can submit crafted XML data that is processed by an XML parser with external entity resolution enabled. Successful exploitation may allow disclosure of sensitive local files from the server. The vulnerability occurs when processing XML data through the SOAP interface.

Recommendations Versions prior to 10.0 and versions after 10.1 are not affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-33371

Affected Products

Zimbra Collaboration

Zimbra Exchange Web Services

References · 6

• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33371 · Security Note
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Note
• https://twitter.com/CVEnew/status/2035627039017803955 · Twitter Post
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_Fixes · Note