XXE in Synacor Zimbra Collaboration Suite
CVE-2026-33371
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacker can submit crafted XML data that is processed by an XML parser with external entity resolution enabled. Successful exploitation may allow disclosure of sensitive local files from the server.
Vulnerability class: XXE (XML External Entity)
EPSS: 0.002 (14.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Synacor Zimbra_collaboration_suite
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org (Release Notes, Vendor Advisory)
- cve@mitre.org (Product)
- cve@mitre.org (Release Notes)
Frequently asked questions
- What is CVE-2026-33371?
- CVE-2026-33371 is a medium-severity vulnerability in Synacor Zimbra Collaboration Suite, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.3/10. Published 2026-03-20.
- How severe is CVE-2026-33371?
- Medium severity. CVSS v3 base score is 4.3 out of 10.