CVE-2026-33369

Executive Summary

CVE-2026-33369 is an LDAP injection vulnerability in Zimbra Collaboration (ZCS) 10.0 and 10.1, affecting the Mailbox SOAP service's FolderAction operation. An authenticated attacker can craft a malicious SOAP request that injects arbitrary LDAP filter syntax into the application's backend directory query, enabling the retrieval of sensitive directory attributes (including credentials, ACLs, or internal user metadata) that should otherwise be inaccessible to the requesting user. The vulnerability is remotely exploitable against internet-facing Zimbra mail servers with valid user credentials, and given Zimbra's widespread deployment in enterprise environments, the leadership advised immediate investigation and patching. The current CVSS score is N/A due to incomplete scoring, but the vector indicates High severity (7.0-8.9) based on network exploitability, low privileges required, and high confidentiality impact.

Technical Analysis

The vulnerability resides in the FolderAction SOAP operation within Zimbra's Mailbox service. The Zimbra SOAP service acts as a front-end for mailbox operations, translating user actions into internal objects and database operations. When a user performs certain folder actions—such as granting permissions, renaming, or modifying folder properties—the service constructs an LDAP search filter to retrieve or update directory objects (e.g., share targets, distribution lists, or user entries) referenced by the request.

The code path that fails is the lack of proper sanitization of the action or folder parameters within the SOAP body before they are concatenated into an LDAP filter string. Specifically, parameters such as folder.owner, folder.grantee, or folder.targetName are taken from the XML request and embedded directly into an LDAP query template, e.g.:

(&(objectClass=zimbraAccount)(mail={user_input}))

An attacker with a valid Zimbra account can alter the mail value to inject LDAP operators like )(objectClass=*))(|(mail=*. This breaks out of the original filter context and appends attacker-controlled predicates, effectively rewriting the LDAP query to return additional objects. The backend LDAP server (typically OpenLDAP or Red Hat Directory Server) processes this manipulated filter and returns directory entries that match the injected conditions.

Zimbra's authentication model relies on this LDAP directory for user provisioning, group memberships, and domain configuration. Because the mailbox SOAP service runs with elevated privileges to perform directory lookups (bind as the Zimbra administrator or a service account), the injection allows the attacker to query attributes beyond their permitted scope. The attack is parameter-based and requires an authenticated SOAP session; however, the LDAP service is typically bound to internal network interfaces only.

Affected Code Path

• Product: Zimbra Collaboration Suite (ZCS)
• Affected Versions: 10.0.x and 10.1.x
• Component: soap → FolderAction handler
• Root Cause: Unsanitized user input used in LDAP filter string construction
• Exploitation Vector: HTTP/HTTPS SOAP request to /service/soap/ endpoint

Exploitation Scenarios

The following describes a concrete attack chain for CVE-2026-33369:

Step 1: Reconnaissance and Authentication The attacker identifies a target Zimbra mail server via Shodan queries (http.title:"Zimbra") or port scanning (TCP 443, 7071 admin port). They must possess valid user credentials — these could come from an earlier phishing campaign, credential stuffing against the webmail login (POST / endpoint), or leaked credentials from a prior data breach. If MFA is not enforced, this hurdle is easily bypassed.

Step 2: Crafting the SOAP Request The attacker crafts a malformed SOAP request to the Mailbox SOAP API, targeting the FolderAction operation. The key parameter is the grantee or owner field. The request is wrapped in a standard SOAP envelope:

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
  <soap:Body>
    <FolderActionRequest xmlns="urn:zimbraMail">
      <action op="grant" grantee="*)(objectClass=*))(|(zimbraId=*" perm="r"/>
    </FolderActionRequest>
  </soap:Body>
</soap:Envelope>

The injected string *)(objectClass=*))(|(zimbraId=* closes the initial LDAP predicate and inserts two new predicates. The final LDAP filter becomes:

(&(objectClass=zimbraAccount)(|(uid=*)(objectClass=*))(|(zimbraId=*))

Step 3: Payload Execution The server passes this filter to the backend LDAP query. Because the injection uses wildcards, the query returns all LDAP entries in the directory that match the injected objectClass=* predicate, effectively dumping the entire directory branch the authenticated service account can read. The SOAP response contains the raw LDAP attribute values, including:

• zimbraMailDeliveryAddress (user email addresses)
• zimbraAccountStatus (account state)
• zimbraPrefPasswordRecoveryEmail (recovery emails)
• userPassword (hashed credentials if the service account has read access to userPassword attribute)

Step 4: Post-Exploitation The attacker obtains a full listing of valid user accounts and hashed password attributes. They can then crack weak hashes offline (MD5/SSHA) and attempt lateral movement into the Zimbra admin interface (TCP 7071) if the admin account credentials are recovered. Additionally, they may use the extracted directory information to perform targeted phishing, account takeover, or persist access by creating new administrative accounts via the compromised LDAP interface.

Impact Assessment

Business Impact: Zimbra is a primary communication backbone for many organizations, often hosting email, calendars, and contacts for thousands of users. A successful exploit leads to:

• Confidentiality Breach (High): Exposure of the entire LDAP directory, including user metadata, hashed passwords, and ACLs. This can extend to corporate domain objects if Zimbra is integrated with Active Directory.
• Integrity Impact (Moderate): The attacker can modify directory attributes (e.g., reset passwords, alter group memberships) if the injected filter is used in a write context, though this CVE focuses on read operations.
• Availability Impact (Low-Moderate): While not directly causing DoS, a mass account takeover or directory corruption can render the mail service unusable.

Affected Systems: All Zimbra ZCS 10.0.x and 10.1.x installations exposed to the internet; the attack surface is further widened to internal networks for LDAP data exfiltration.

Blast Radius: Due to the administrative bound of the Mailbox SOAP service, the attack can read system-wide LDAP data, not just the attacker's own account bucket. This elevates the impact from a single-tenant compromise to a full directory dump.

CVSS Subscore Reflection: The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a base score of approximately 6.5 (Medium), but this under-represents the severity because the confidentiality impact (C:H) is assessed against a single user's data, not the entire directory. From an enterprise risk perspective, treat this as High (7.0-8.9) due to the potential for mass data exfiltration and downstream account compromises.

Detection Guidance

Sigma Rule

title: Zimbra FolderAction LDAP Injection Attempt
id: 0f3f0d62-5c7a-4b8d-b960-0f6f8d4e2a11
status: experimental
description: Detects SOAP requests to Zimbra mail service attempting to inject LDAP filter syntax into FolderAction parameters.
author: Valters IT Threat Intelligence
date: 2026/02/14
logsource:
  category: webserver
  product: zimbra
  service: mail
detection:
  selection:
    cs-method: 'POST'
    cs-uri-path: '/service/soap/'
    cs-username|contains|all:
      - 'FolderActionRequest'
    cs-body|contains|all:
      - '(objectClass='
      - ')(|('
      - '(|('
  condition: selection
level: high
falsepositives:
  - None expected - normal Zimbra clients do not send LDAP filter syntax in SOAP parameters
tags:
  - attack.t1190
  - cve.2026.33369

YARA Rule

rule Zimbra_LDAP_Injection_CVE_2026_33369
{
    meta:
        author = "Valters IT Threat Intelligence"
        date = "2026-02-14"
        description = "Detects LDAP injection patterns in Zimbra SOAP FolderAction request bodies"
        cve = "CVE-2026-33369"
        severity = "high"
    strings:
        $soap = /<FolderActionRequest/
        $inject1 = /\)\(objectClass=\*/
        $inject2 = /\)\(mail=\*/
        $inject3 = /\(&\s*\(objectClass=\*\)\s*\(&\s*\(/
        $inject4 = /\)\|\s*\(/
    condition:
        $soap and (any of ($inject*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-33369 - Zimbra FolderAction LDAP Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/service/soap/"; http_uri; content:"FolderActionRequest"; http_client_body; pcre:"/\)(\||\()\(objectClass=\*/i"; classtype:attempted-admin; sid:202633369; rev:1; reference:cve,2026-33369;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where event.type == "start" and destination.port == 443 ]
  [ any where 
      (file and process.name : "java" and file.path : "*weblogic*" ) or
      (network and destination.port : 389 and network.protocol : "ldap")
  ]

Note: A more precise EQL rule targeting HTTP logs:

http where process.name == "java" and 
  url.path == "/service/soap/" and 
  body.text matches "*FolderActionRequest*objectClass=*)(|("*

Splunk SPL Query

sourcetype="zimbra:mailbox:soap" 
| search "FolderActionRequest" AND "objectClass=" AND ")(|("
| table _time, src_ip, user, request_body
| eval alert="CVE-2026-33369 LDAP Injection Attempt"
| stats count by _time, src_ip, user

Alternatively, querying Apache access logs:

index=web sourcetype="zimbra:accesslog" 
| search "POST /service/soap/" 
| rex field=_raw "\"(?<body>[^\"]*FolderActionRequest[^\"]*)\""
| where body LIKE "%&(objectClass=*)%"
| table _time, src_ip, user_id, body

Wazuh OSSEC Rule

<group name="zimbra,">
  <rule id="100333" level="12">
    <decoded as="json">null</decoded>
    <field name="url">/service/soap/</field>
    <field name="http_method">POST</field>
    <match severity="error">FolderActionRequest\(</match>
    <regex>objectClass=\*\)}\(\|\(</regex>
    <description>Zimbra CVE-2026-33369 - LDAP injection attempt in FolderAction SOAP request from $(srcip)</description>
    <group>attack.t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status Confidence: 2/4 — CLAIMED — a single patch source (OSV) claims a fix exists, but it has not been independently confirmed or publicly released by Zimbra. Proceed with the following layered mitigations under the assumption that the vulnerability is currently UNPATCHED.

1. Immediate Mitigations (Compensating Controls):

   • Restrict SOAP API Access: Block or rate-limit access to /service/soap/ from untrusted networks. If external access is required, place it behind a reverse proxy with strict WAF rules that filter LDAP filter syntax (e.g., reject requests containing )(|( or objectClass=* in POST bodies).
   • Enforce MFA on all Zimbra accounts: This vulnerability requires valid credentials; MFA significantly raises the barrier to entry.
   • Network Segmentation: Ensure the Zimbra server's LDAP backend (typically localhost or internal) is not directly routable from the network segment where the SOAP service is exposed.

2. Patch/Upgrade Steps:

   • Monitor Zimbra's official security advisories and OSV feeds. When a confirmed patch is released, upgrade ZCS 10.x to the patched minor version immediately.
   • Until then, apply vendor-provided hotfixes if available. If no patch exists, consider downgrading the SOAP service privilege by running it under a least-privileged LDAP bind account that lacks read access to sensitive attributes (e.g., userPassword).

3. Long-Term Hardening:

   • Input Validation: Architecturally require that all SOAP input be validated against a strict whitelist of allowed characters and regex patterns before use in backend queries.
   • Parameterized LDAP Queries: If a code fix is not immediately available, instrument the Zimbra codebase (via a local patch or library replacement) to use LDAP query parameterization, preventing injection at the protocol level.
   • Audit Logging: Enable full SOAP request logging for security monitoring, and integrate with the SIEM using the detection rules above.
   • Privilege Reduction: Restrict the directory service account used by the Mailbox SOAP service to read access only for the minimum object classes required, and explicitly deny read access to userPassword and zimbraAdminAuthToken attributes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-33369 (Official CVE record, CVSS N/A, source of affected versions).
2. OSV Entry: https://osv.dev/vulnerability/CVE-2026-33369 (Patch confidence metadata, claimed patch source).
3. Zimbra Security Advisories: https://www.zimbra.com/security/ (Official vendor patch announcements; check for ZCS 10.0.x and 10.1.x releases).
4. MITRE ATT&CK Database: https://attack.mitre.org/techniques/T1190/ (Exploitation of public-facing application technique framework).
5. Shodan Internet Search Reference: https://www.shodan.io/search?query=http.title%3A%22Zimbra%22 (Demonstrates the internet-facing attack surface).

Threat Actor Campaigns / In-the-Wild Evidence: As of this report's writing, no publicly documented exploit-in-the-wild campaigns have been associated with CVE-2026-33369. The EPSS score of 0.00227 (13.5th percentile) indicates a low to moderate probability of exploitation in the near term. However, Zimbra has historically been a primary target for Chinese APT groups (e.g., UNC3890, APT28) who rapidly weaponize such vulnerabilities; threat hunters should treat any successful LDAP injection exploitation as a precursor to broader network compromise.