Login Request a demo
Critical severity · published Sep 25, 2026
CVE-2026-93647
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address
9.3
CVSS
0.2%
EPSS
No
On KEV
Description
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZC
Zimbra Collaboration Suite (ZCS) · Zimbra
before 10.1.21 · source: vendor
Affected product
ZC
Zimbra Collaboration Suite (ZCS)
Zimbra
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93647
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93647
vendor-advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
More from Zimbra Collaboration Suite (ZCS)
9.8
CVE-2026-93643
Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request
9.3
CVE-2026-93642
Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation
9.3
CVE-2026-93641
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation