All vulnerabilities
CVE-2026-93641

Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

Zimbra Zimbra Collaboration Suite (ZCS)Applications & CMS
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.1.21Fixed versionCVE List
Published25 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

  • 10.1.21Zimbra Collaboration Suite (ZCS)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

Text from CVE List

Affected versions 1

  • Zimbra Collaboration Suite (ZCS)affected: all versions before 10.1.21CVE List

References 1