CVE-2026-33371
Received Received - Intake
XXE Vulnerability in Zimbra EWS Allows Sensitive File Disclosure

Publication date: 2026-03-20

Last updated on: 2026-04-01

Assigner: MITRE

Description
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacker can submit crafted XML data that is processed by an XML parser with external entity resolution enabled. Successful exploitation may allow disclosure of sensitive local files from the server.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-04-01
Generated
2026-06-16
AI Q&A
2026-03-20
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33371
EUVD
EUVD-2026-13696
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
synacor zimbra_collaboration_suite From 10.0.0 (inc) to 10.1.16 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an XML External Entity (XXE) issue found in Zimbra Collaboration (ZCS) versions 10.0 and 10.1. It exists in the Zimbra Exchange Web Services (EWS) SOAP interface because the system improperly handles XML input. Specifically, an authenticated attacker can submit specially crafted XML data that is processed by an XML parser with external entity resolution enabled.

This improper handling allows the attacker to exploit the XML parser to access and disclose sensitive local files from the server.

Impact Analysis

The impact of this vulnerability is that an authenticated attacker could gain unauthorized access to sensitive local files on the server running Zimbra Collaboration. This could lead to the disclosure of confidential information stored on the server.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33371. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart