CVE-2026-33371

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacker can submit crafted XML data that is processed by an XML parser with external entity resolution enabled. Successful exploitation may allow disclosure of sensitive local files from the server.

• CWE-611

• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_FixesRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33362In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 2…8.6
• CVE-2026-33366Missing authentication for critical function vulnerability i…6.9
• CVE-2026-33368Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a re…6.1
• CVE-2026-33369Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP in…4.3
• CVE-2026-3337Observable timing discrepancy in AES-CCM decryption in AWS-L…8.2
• CVE-2026-33370An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…6.1
• CVE-2026-33372An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…5.4
• CVE-2026-33373An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…8.8
• CVE-2026-33375The Grafana MSSQL data source plugin contains a logic flaw t…6.5
• CVE-2026-33376When using an IPv6 allow-list for the Auth Proxy feature, it…7.4
• CVE-2026-33377An Editor can overwrite a dashboard not owned by them to acq…7.1
• CVE-2026-33378Using the $__timeGroup macro, one can achieve an OOM by over…6.5