CVE-2026-73575: 
Zimbra Collaboration Server vulnerability analysis and mitigation

CVE-2026-73575 is a Cross-Site Request Forgery (CSRF) vulnerability in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) affecting versions before 10.1.17. The flaw arises from insufficient validation of request content types, allowing an attacker to trick an authenticated user into submitting a crafted request that performs unauthorized actions on their behalf. It was published on August 13, 2026, with a patch available in ZCS 10.1.17. The vulnerability carries a CVSS v3.1 base score of 3.1 (Low) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from the EWS endpoint in Zimbra Collaboration failing to adequately validate the content type of incoming requests, making it susceptible to cross-origin request forgery. An attacker exploits this by crafting a malicious web page or link that, when visited by an authenticated Zimbra user, silently submits a forged request to the EWS endpoint on the victim's behalf. Exploitation requires user interaction (the victim must visit an attacker-controlled resource while authenticated) and has high attack complexity, limiting its practical impact. No public proof-of-concept code has been identified (GitHub Advisory, Feedly).

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions through the EWS endpoint on behalf of an authenticated Zimbra user, resulting in a low integrity impact with no confidentiality or availability impact. The scope is unchanged, meaning the attack is confined to the vulnerable component and does not enable lateral movement or privilege escalation beyond the victim's existing permissions. The practical risk is limited to unauthorized modifications or actions within the victim's Zimbra account context (GitHub Advisory, Feedly).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2026-73575 (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" and automation as "no." The EPSS score is approximately 0.112% (1st percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory).

1. Reconnaissance: Identify Zimbra Collaboration instances running versions prior to 10.1.17 that expose the EWS endpoint, using tools such as Shodan or Censys to locate internet-facing deployments.
2. Craft malicious request: Construct a forged HTTP request targeting the Zimbra EWS endpoint with a content type that bypasses the server's insufficient validation, designed to perform a specific action (e.g., modifying calendar entries, sending emails) on behalf of the victim.
3. Deliver payload: Host the crafted request in a malicious web page (e.g., via an <img>, <form>, or <script> tag with auto-submit) and lure an authenticated Zimbra user to visit it through phishing or social engineering.
4. Trigger unauthorized action: When the authenticated victim loads the attacker's page, the browser automatically submits the forged request to the Zimbra EWS endpoint, carrying the victim's session credentials and executing the unauthorized action on their behalf (GitHub Advisory, Feedly).

• Network: Unexpected or anomalous HTTP requests to the Zimbra EWS endpoint (/ews/ or similar paths) originating from unusual referrer domains or with atypical content-type headers.
• Logs: Zimbra access logs showing EWS endpoint requests with cross-origin Referer headers pointing to external or unknown domains; requests with mismatched or missing Content-Type headers.
• Application: Unexplained changes to authenticated user account settings, calendar entries, contacts, or outbound emails that the user did not initiate, potentially indicating a successful CSRF action.

The primary remediation is to upgrade Zimbra Collaboration to version 10.1.17 or later, which addresses the insufficient content-type validation in the EWS endpoint (GitHub Advisory, Zimbra Security Advisories). As interim mitigations, administrators should implement SameSite=Strict or SameSite=Lax cookie attributes to reduce CSRF risk, enforce strict Content-Type validation on EWS requests at the WAF or reverse proxy level, and add security headers such as X-Frame-Options to prevent clickjacking-assisted attacks. Users should be advised not to click suspicious links while authenticated to Zimbra.