CVE-2026-33371

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacker can submit crafted XML data that is processed by an XML parser with external entity resolution enabled. Successful exploitation may allow disclosure of sensitive local files from the server.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-333725.4An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability exists in Zimbra Webm CVE-2026-333738.8An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web CVE-2026-333746.5The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded me CVE-2026-333756.5The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger CVE-2026-333767.4When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affec CVE-2026-333777.1An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the da CVE-2026-333786.5Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to a CVE-2026-33387.5Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PK CVE-2026-333806.5A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only insta CVE-2026-333818.1When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the ev CVE-2026-333827.5Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can CVE-2026-333844.8QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authenticatio