Zimbra Collaboration Suite EUVD-2026-87101

Requires the OnlyOffice/Document Editing integration to be available/enabled on the Zimbra server (a non-default add-on component), and the attacker must have access to an existing supported PUBLIC Briefcase document, which provides the unauthenticated entry point. The concrete flaw is abuse of unsigned save fields to perform path-traversal writes that result in command execution as the zimbra system account. Limiting factors: deployments without OnlyOffice document editing, or without publicly accessible supported Briefcase documents, are not exploitable via this path; the fixed/patched version could not be confirmed from the single wiki reference provided.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) portrays this as a maximally severe, remote, unauthenticated command-execution flaw in Zimbra Collaboration Suite, and command execution as the 'zimbra' service account plausibly justifies the C:H/I:H/A:H impact triad. However, the raw score understates real-world gating: exploitation is explicitly conditional on the OnlyOffice/Document Editing integration being available AND the attacker having access to an existing supported PUBLIC Briefcase document. That makes AC:L optimistic - the OnlyOffice add-on is a non-default, separately-provisioned component, so realistically this behaves closer to AC:H. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no confirmed active exploitation - status is 'no public exploit identified at time of analysis.' Weighing signals: this is a genuine high-priority patch target because Zimbra is a historically favored, internet-facing target and the outcome (RCE as zimbra) is severe, but the OnlyOffice/public-Briefcase preconditions mean it is not universally exploitable against every ZCS deployment. Treat as high priority specifically for installs that expose OnlyOffice document editing.

An unauthenticated remote attacker locates a Zimbra server with OnlyOffice/Document Editing enabled and reachable public Briefcase documents, opens such a document, and abuses the unsigned save fields to write attacker-controlled content outside the intended directory via path traversal. The traversal write lands in a location that leads to command execution as the zimbra user, giving the attacker code execution on the mail server. No public proof-of-concept was identified at time of analysis.