CVE-2026-66912
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Zimbra Classic UI via Malicious From Header

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: CERT.PL

Description
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the unsanitized From header content is rendered as HTML and the JavaScript payload executes in the victim's browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim. This issue was fixed in version 10.1.21

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-66912
EUVD
EUVD-2026-112942

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Synacor Zimbra Collaboration 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. A remote attacker sends a crafted email with a malicious JavaScript payload in the From header. When the victim opens the message and clicks Reply in HTML mode with reply headers disabled, the unsanitized From header content executes the payload in the victim's browser, potentially stealing session information or performing unauthorized actions.

Detection Guidance

This vulnerability can be detected by checking the Zimbra version installed on your system. If the version is below 10.1.21, the system is vulnerable. Use commands like 'zmcontrol -v' to check the Zimbra version.

Impact Analysis

This vulnerability allows an attacker to execute malicious JavaScript in your browser when you interact with a crafted email. This could lead to session hijacking, theft of sensitive data like cookies or credentials, or unauthorized actions performed on your behalf while logged into Zimbra.

Mitigation Strategies

Immediately upgrade Zimbra Collaboration to version 10.1.21 or later to patch the vulnerability. Ensure all instances are updated to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66912. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart