CVE-2026-10632
Awaiting Analysis Awaiting Analysis - Queue

Reflected XSS in Zimbra Collaboration Suite Classic Web Client

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: Rapid7, Inc.

Description
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-23
Last Modified
2026-10-23
Generated
2026-10-23
AI Q&A
2026-10-23
EPSS Evaluated
N/A
NVD
CVE-2026-10632
EUVD
EUVD-2026-108961

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Zimbra Zimbra Collaboration Suite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite's Classic Web Client. It allows an attacker to inject JavaScript code via the packages parameter in the document editor URL. The editor fails to properly encode package names into script attributes, enabling malicious script execution when a victim opens a crafted URL.

Detection Guidance

This vulnerability involves reflected cross-site scripting in Zimbra's Classic Web Client via the packages parameter. Detection requires checking Zimbra versions and inspecting web traffic for suspicious URLs targeting the /h/rest document editor with JavaScript payloads in the packages parameter.

Impact Analysis

An attacker could read your mailbox data and perform authenticated actions on your behalf, such as sending emails or modifying settings. This requires tricking you into clicking a malicious link while you are logged into your Zimbra account.

Mitigation Strategies

Upgrade Zimbra Collaboration Suite to version 10.1.17 or later, which remediates the issue. If immediate upgrade is not possible, restrict access to the /h/rest document editor endpoint and monitor for unusual activity in web traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10632. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart