Vulnerability · Published Sep 25, 2026 · Assigned by rapid7
CVE-2026-93642Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation
Critical 9.3
In plain English
A critical-severity cross-site scripting in Zimbra Collaboration Suite (ZCS) from Zimbra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.2%top 86.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zimbra | Zimbra Collaboration Suite (ZCS) | 0 – before 10.1.21 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories vendor-advisory