Zimbra Collaboration Suite EUVD-2026-108963

Exploitation requires that the target run an affected Zimbra Collaboration Suite build (10.1.16 or 10.1.21) and that the attacker know, per target, the exact meeting UID and the organizer's email address and supply a non-outdated (current or higher) iCalendar sequence number in a CANCEL or REQUEST component. No authentication (PR:N) and no recipient interaction (UI:N) are needed because the calendar component is processed automatically during email delivery. The practical limiting factors are the target-specific knowledge of UID and valid sequence number and the fact that impact is confined to integrity of individual calendar entries (cancel/modify/replace) - there is no confidentiality exposure, no broader system availability loss, and no code execution.

Signals point to a genuine but moderate-priority issue rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) correctly captures an unauthenticated, network-reachable, no-interaction flaw whose impact is limited to integrity of calendar data (I:L) with no confidentiality or availability loss. The vuln.today decision label is 'this_month', not act_now/emergency, which is consistent with the medium severity. No EPSS score and no CISA KEV status are present in the input, so widespread or active exploitation is not evidenced; the flaw was reported by Rapid7 and documented in their research blog, meaning the technique is publicly described. One tension worth flagging: NVD rates AC:L, but successful exploitation requires target-specific knowledge (the exact meeting UID plus the organizer's address plus a non-outdated iCalendar sequence number), which in practice raises attack complexity and argues against treating every CVSS signal at face value. Net: a real, unauthenticated integrity-manipulation bug that merits timely patching but is not a drop-everything event, and the absence of EPSS/KEV data should be noted rather than assumed benign.

An attacker who has learned a victim's meeting UID and the organizer's email address crafts a spoofed email containing an iCalendar CANCEL or REQUEST component with a current-or-higher sequence number and sends it to the recipient. Because Zimbra processes the calendar component automatically during email delivery without verifying the sender is the real organizer and without recipient interaction, the victim's meeting is silently moved to Trash or its details are replaced. No confirmed working exploit code is flagged in the input, though Rapid7's research blog publicly documents the identity-boundary technique.