Zimbra Collaboration Suite EUVD-2026-108975

Requires an authenticated Zimbra account able to issue a SearchCalendarResourcesRequest (PR:L) - this is standard account functionality, not a non-default feature, so no special server configuration toggle is named in the sources. Exploitation is inherently scoped and limited: results are restricted to calendar-resource LDAP objects and constrained by the LDAP service account's access rights, so only attributes that account can read (e.g., internal mailbox hostnames, mail transport routes) are recoverable, and recovery proceeds through repeated matching (boolean-oracle) queries rather than a single direct read. Principal limiting factors for defenders: valid authentication is mandatory, no privilege escalation or data modification is possible (I:N/A:N), and the disclosed data is low-sensitivity operational metadata rather than credentials or message bodies.

This is a genuine but modest-severity information-disclosure issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent: network-reachable, low complexity, but requires an authenticated account (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. The vuln.today Decision label is 'this_month' - a routine remediation priority, not act_now/emergency - which is consistent with the limited impact. No CISA KEV listing and no EPSS score were provided in the input, so there is no signal of active or probable widespread exploitation; absence of these is not evidence of safety but also does not elevate urgency. The vulnerability was reported by Rapid7, which published a technical blog describing the research, so the mechanism is well understood publicly even though the input does not mark a working exploit as confirmed. Key limiting factor to weigh against the network vector: exploitation is scoped to calendar-resource LDAP objects and bounded by the LDAP service account's access rights, and it leaks low-sensitivity operational metadata (internal mailbox hostnames, mail transport routes) rather than credentials or message content. Net: a real priority to patch on a normal cycle, but not a drop-everything issue. Missing data to note explicitly: no EPSS, no KEV status, and no SSVC decision-point breakdown were supplied, and no fixed version is stated in the available sources.

An authenticated Zimbra user issues a SearchCalendarResourcesRequest in which the supplied attribute names are inserted unvalidated into the server's LDAP filter, letting the attacker inject additional boolean conditions. By running repeated matching queries and observing which return results, they enumerate otherwise-unreturned calendar-resource attributes such as internal mailbox hostnames and mail transport routes. Rapid7 published a technical writeup describing this technique; the input does not confirm a packaged working exploit.