CVE-2026-73575 is a CSRF vulnerability in Zimbra Collaboration (ZCS) versions prior to 10.1.17. It affects the Exchange Web Services (EWS) endpoint due to insufficient validation of request content types. This flaw could allow an attacker to cause an authenticated user to unknowingly submit a malicious request, potentially leading to unauthorized actions being executed on the victim's behalf. The CVSS v3.1 base score is 3.1, indicating low severity, with attack vector network, high attack complexity, no privileges required, user interaction required, and limited impact on integrity only.

The vulnerability could allow unauthorized actions to be performed via CSRF attacks on the EWS endpoint by tricking authenticated users into submitting crafted requests. The impact is limited to integrity with no confidentiality or availability impact. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard CSRF mitigations where possible, such as ensuring proper validation of request origins and content types. Monitor vendor communications for updates on patches or official mitigations.