Zimbra Collaboration Suite EUVD-2026-108965

Exploitation requires that the target Zimbra deployment has automatic invitation insertion enabled and that its email delivery path accepts external invitations - the crafted iCalendar REQUEST component is auto-processed into an event without recipient interaction. The attacker needs no authentication (PR:N) and sets an attacker-chosen ORGANIZER value to impersonate another user; no corresponding event is created in the claimed organizer's real calendar. The principal limiting factor is the automatic-insertion feature: deployments where this is disabled or where external calendar invitations are filtered are not exposed by default. Impact is bounded to forged/spoofed calendar entries (integrity) - it does not grant data access or code execution. Whether automatic insertion is the shipped default for the affected 10.1.x builds is not stated in the available sources.

This is a medium-severity integrity flaw (CVSS 5.3) that is best treated as a priority to patch this cycle rather than an emergency, matching the input Decision label of 'this_month'. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, unauthenticated, low-complexity attack requiring no user interaction, and the sole impact is a limited integrity violation (I:L) with no confidentiality or availability consequence (C:N/A:N) - consistent with CWE-290 (authentication bypass by spoofing of the iCalendar ORGANIZER identity). No EPSS score was provided, so exploitation probability cannot be quantified from this data. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation. A Rapid7 research reference exists ('Breaking Zimbra Identity Boundaries, Part 1'), so this should be regarded as a public PoC/technique reference rather than verified working exploit code. The limiting factor that keeps real-world risk moderate rather than critical is that exploitation depends on the 'automatic invitation insertion' feature being enabled - a deployment-dependent precondition. Net: a credible, low-complexity spoofing/forgery issue worth remediating promptly, but its bounded impact (forged calendar entries, no data disclosure or system compromise) places it below the tier of a drop-everything emergency.

An attacker sends a crafted external email containing an iCalendar REQUEST component to a Zimbra user whose tenant has automatic invitation insertion enabled, setting the ORGANIZER field to a trusted colleague or executive the attacker is impersonating. Because the delivery path does not verify the sender is authorized to use that ORGANIZER identity, a meeting with attacker-chosen details and reminders is auto-created on the victim's calendar under the forged organizer, with no recipient interaction. A Rapid7 technical write-up describing the identity-boundary weakness is publicly referenced, though it is not verified as working exploit code.