All vulnerabilities
CVE-2026-93647

Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

Zimbra Zimbra Collaboration Suite (ZCS)Applications & CMS
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.1.21Fixed versionCVE List
Published25 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

  • 10.1.21Zimbra Collaboration Suite (ZCS)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

Text from CVE List

Affected versions 1

  • Zimbra Collaboration Suite (ZCS)affected: all versions before 10.1.21CVE List

References 1