CVE-2026-115786: medium-severity vulnerability in Zimbra Collaboration Suite
Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.4%
A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Zimbra · Zimbra Collaboration SuiteRelated CVEs — Zimbra Collaboration Suite
In the same product, most dangerous first.
CVE-2026-115785MEDIUMZimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email AddressEPSS 0.7%CVE-2026-93639HIGHZimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege EscalationEPSS 0.4%CVE-2026-50055MEDIUMZimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable ExpansionEPSS 0.4%CVE-2026-50056HIGHZimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument InjectionEPSS 0.3%CVE-2026-93636MEDIUMZimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute NameEPSS 0.3%CVE-2026-93637LOWZimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate LimitingEPSS 0.3%