Paper/Archive/CVE-2026-93647

CVE-2026-93647

Zimbra Zimbra Collaboration Suite (ZCS) — Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

EPSS 0.2%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 13.8.138 × 202.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

Affected

ProductAffectedFixed inSource

Zimbra Collaboration Suite (ZCS)< 10.1.2110.1.21CNA

Scores by source

rapid7 (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorywiki.zimbra.com/wiki/Zimbra_Security_Advisories