CVE-2026-73572: 
Zimbra Collaboration Server vulnerability analysis and mitigation

CVE-2026-73572 is a stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration (ZCS) Classic Web Client affecting versions before 10.1.17. The flaw stems from insufficient sanitization of specific attachment content during inline preview, allowing an attacker to send a crafted email with a malicious attachment that executes arbitrary JavaScript in the victim's browser when previewed. It was published on August 13, 2026, with a patch available in version 10.1.17. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically a stored XSS variant. The attack vector is network-based and requires no privileges, but does require user interaction (the victim must preview the malicious attachment in the Zimbra Classic Web Client). The vulnerability arises because the inline attachment preview feature fails to adequately sanitize or escape malicious content embedded in certain attachment types before rendering them in the browser, allowing injected JavaScript to execute in the context of the victim's authenticated session (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript within the victim's browser session, enabling unauthorized actions on behalf of the victim such as session hijacking, credential theft, or unauthorized access to sensitive email data. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component itself to the victim's browser context. Confidentiality and integrity are both partially impacted, with potential for data exfiltration from the victim's Zimbra account; availability is not directly affected (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not automatable, requiring user interaction to trigger. The EPSS score is approximately 0.155%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft malicious attachment: Prepare an email attachment (e.g., an HTML or specially crafted file) containing embedded JavaScript payloads that exploit the insufficient sanitization in Zimbra's inline preview renderer.
2. Send the email: Deliver the crafted email to a target Zimbra user account. No authentication or prior access to the target system is required by the attacker.
3. Wait for victim interaction: The attack is triggered when the victim opens or previews the malicious attachment using the Zimbra Classic Web Client's inline preview feature.
4. JavaScript execution: Upon preview, the unsanitized attachment content is rendered in the victim's browser, executing the injected JavaScript within the victim's authenticated Zimbra session.
5. Post-exploitation: The attacker's script can perform actions such as stealing session cookies, exfiltrating email content, sending emails on behalf of the victim, or redirecting the user to a phishing page (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the victim's browser to unexpected external domains immediately following attachment preview actions in Zimbra webmail.
• Logs: Zimbra web server access logs showing requests to attachment preview endpoints followed by unusual API calls (e.g., sending emails, accessing contacts) from the same session.
• Logs: Browser-side console errors or unexpected JavaScript execution events logged by endpoint security tools during Zimbra Classic Web Client sessions.
• File System: Unexpected files or scripts written to disk if the XSS payload includes a download or dropper component.
• Process: Unusual child processes or network connections initiated from the browser process after a Zimbra attachment preview event.

Zimbra has released version 10.1.17 which addresses this vulnerability; administrators should upgrade Zimbra Collaboration to 10.1.17 or later as the primary remediation (Zimbra Security Advisories). As a temporary workaround prior to patching, organizations should educate users to avoid previewing attachments from untrusted or unknown senders and consider disabling inline attachment preview functionality if the Zimbra configuration permits. Implementing network-level email filtering to detect and quarantine suspicious attachments can provide an additional layer of defense.