PT-2026-26616 · Zimbra · Zimbra Collaboration

Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-33372

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 10.0 and 10.1

Description A cross-site request forgery (CSRF) issue was identified in Zimbra Webmail. The application does not properly validate CSRF tokens, accepting them from the request body instead of the expected request header. This allows an attacker to potentially perform unauthorized actions on behalf of an authenticated user by submitting a crafted request.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-33372

Affected Products

Zimbra Collaboration

References · 6

• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33372 · Security Note
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_Fixes · Note
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Note
• https://twitter.com/CVEnew/status/2035627039902900555 · Twitter Post