CVE-2016-3406

CVE-2016-3406 describes multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Zimbra Collaboration versions prior to 8.7.0. These flaws allow remote attackers to hijack authenticated user sessions through specially crafted requests targeting the Client uploader extension or extension REST handlers. The vulnerability carries a high CVSSv3 score of 8.8, indicating a critical risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability impacts. Despite its severity, there is no evidence of active exploitation, publicly available exploit code in common frameworks like Metasploit or Nuclei, nor significant community discussion or media coverage surrounding this CVE.