CVE-2026-115786 Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115786?
CVE-2026-115786 is a medium-severity vulnerability in Zimbra Collaboration Suite, published on 23 Oct 2026.
Official description
A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.
Weakness: CWE-682
Which versions are affected by CVE-2026-115786?
How do I fix CVE-2026-115786?
No fix has been published for CVE-2026-115786 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115786 being exploited?
There is no known exploitation of CVE-2026-115786 in the wild and no public exploit code.
Sources
Also known as GHSA-w5xc-29c5-3j2h.