Zimbra Collaboration CVE-2026-73576

Exploitation requires the attacker to hold a valid Zimbra account with sufficient permissions to trigger OnlyOffice document editing (PR:L), which is necessary to obtain a legitimately-issued JWT to brute-force against. The OnlyOffice integration must be enabled - this is an optional integration, not enabled by default in all Zimbra deployments. The attacker must also be able to capture a JWT in transit (via network interception, log access, or proxy position) and must have adequate compute resources to brute-force a low-entropy secret offline. High attack complexity (AC:H) reflects these combined prerequisites. What limits exploitation: initial valid credentials are required; the OnlyOffice feature must be active; JWT capture requires some network or system access; and brute-force success depends on how poorly-seeded the PRNG actually is in practice, which may vary by OS and JVM configuration. Remote unauthenticated exploitation is not possible per the PR:L CVSS rating.

The CVSS vector AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N captures several important constraints: exploitation requires an authenticated Zimbra session (PR:L), high attack complexity (AC:H) due to the need to capture a JWT and then successfully brute-force the secret, and yields a scope change (S:C) reflecting that forged tokens affect the OnlyOffice subsystem. The base score of 6.3 is appropriate - this is not a trivial unauthenticated flaw. No EPSS data was provided in the intelligence, so exploitation probability cannot be independently quantified; that absence is a data gap, not confirmation of safety. No KEV listing exists and no public exploit code has been identified at time of analysis, suggesting this has not been broadly weaponized. Real-world risk is highest in environments where OnlyOffice integration is actively used and where internal network monitoring is weak, as JWT capture depends on some degree of network or log access. The C:N rating in the official vector is conservative - JWT forgery enabling impersonation plausibly yields confidential document access - which this assessment adjusts to C:L independently.

An authenticated Zimbra user opens a document for editing, triggering issuance of a JWT signed with the low-entropy zimbraDocumentEditingJwtSecret; the attacker captures this token from network traffic or server logs, then runs an offline brute-force tool against the token to recover the signing secret. With the recovered secret, the attacker forges new JWTs impersonating arbitrary users and submits them to the OnlyOffice server to access or modify other users' documents without authorization. No public exploit code has been identified at time of analysis.