CVE-2026-73576
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In Zimbra Collaboration (ZCS) before 10.1.17, there is a vulnerability involving weak cryptographic key generation in the OnlyOffice integration. The JWT secret (zimbraDocumentEditingJwtSecret) is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with this secret may be able to recover it through offline brute-force, potentially enabling JWT forgery.
Risk Assessment
The risk is the potential for JWT forgery, which could lead to unauthorized access to document editing features and possibly compromise data integrity.
Recommendation
It is recommended to immediately upgrade Zimbra Collaboration to version 10.1.17 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with the generated secret may be able to recover the JWT signing secret through offline brute-force, potentially enabling JWT forgery.