Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

Description

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

Affected Products

Vendor	Product	Versions
zimbra	zimbra collaboration suite (zcs)	0

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories(vendor-advisory)

Related News (1 articles)

Tier C

VulDB2d ago

CVE-2026-93647 | Zimbra Collaboration Suite up to 10.1.20 COUNTER Message cross site scripting

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.19.3 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

10.1.21

CWECWE-79

PublishedSep 25, 2026

Trending Score24

Source articles1

Independent1

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-93643

Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request

Trending: 32

CRITICALCVE-2026-93641

Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

Trending: 24

CRITICALCVE-2026-93642

Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

Trending: 24

LOWCVE-2026-73574

CVE-2026-73574: In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Clie

MEDIUMCVE-2026-73572

CVE-2026-73572: In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Cla

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Sep 25, 2026

Discovered by ZDM

Sep 25, 2026

Patch Available

Sep 26, 2026