CVE-2026-33373 — An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A…
🚨 CVE-2026-33373 An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions.
Security Center - Zimbra :: Tech Center
wiki.zimbra.com
What This Means For You
- New vulnerability disclosed — verify if your stack is exposed.
Related ATT&CK Techniques
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-33373 | CSRF | Zimbra Collaboration (ZCS) 10.0, 10.1. Zimbra Web Client. Authentication tokens issued during account state transitions (e.g., enabling 2FA, changing password) lack CSRF protection. |
| CVE-2026-33373 | Auth Bypass | Zimbra Collaboration (ZCS) 10.0, 10.1. Zimbra Web Client. Exploitable via crafted requests to trigger sensitive account actions (e.g., disabling 2FA) without CSRF validation when an unvalidated token is active. |
🛠 Recommended Tools
🛡️
Want the IOCs from this threat?
Get structured IOC exports and weekly threat briefs — delivered instantly to your Telegram.
Get My Intel →
Source & Attribution
| Source Platform | Telegram |
| Channel | CVE Notify |
| Channel ID | 1129491012 |
| Message ID | 158336 |
| Published | April 07, 2026 at 21:56 UTC |
| Original Link | https://wiki.zimbra.com/wiki/Security_Center |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Found this interesting? Follow us to stay ahead.
Share