CVE-2026-73576

Katalog CVE

CVSS 6.5 · Medium EPSS 0,33%

Kerentanan Use of Predictable Algorithm in Random Number Generator pada synacor zimbra collaboration suite. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with the generated secret may be able to recover the JWT signing secret through offline brute-force, potentially enabling JWT forgery.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

28 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1241: Use of Predictable Algorithm in Random Number Generator

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy advisory vendor
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories advisory vendor