CVE-2026-93647

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Zimbra Collaboration Suite

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: Rapid7, Inc.

Description

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-93647

EUVD

EUVD-2026-87102

Affected Vendors & Products

Vendor	Product	Version / Range
zimbra	zimbra_collaboration	10.0.16
zimbra	zimbra_collaboration	10.1.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated attacker to inject active markup into the RFC From address of a COUNTER message in Zimbra. When a victim selects the malicious message in Zimbra Classic, it triggers stored cross-site scripting (XSS), enabling the attacker to access the victim's mailbox data and perform actions on their behalf.

Detection Guidance

This vulnerability involves unauthenticated calendar sender manipulation leading to stored XSS in Zimbra Classic. Detection requires checking Zimbra server logs for suspicious COUNTER messages with unusual RFC From addresses containing active markup. Review mailbox access logs for unauthorized actions after message selection.

Impact Analysis

An attacker could steal sensitive data from your mailbox, send emails as you, or perform other unauthorized actions. The high CVSS score (9.3) indicates severe impact, including potential data breaches and account compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Apply the latest security patches or updates provided by Zimbra to address the stored XSS vulnerability in the COUNTER message's RFC From address. Disable or restrict access to Zimbra Classic until the patch is applied. Monitor incoming messages for suspicious markup in the From address field.

Hi! I’m here to help you understand CVE-2026-93647. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70