Vulnerability · Published Sep 25, 2026 · Assigned by rapid7
CVE-2026-93641Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
Critical 9.3
In plain English
A critical-severity cross-site scripting in Zimbra Collaboration Suite (ZCS) from Zimbra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.3%top 80.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zimbra | Zimbra Collaboration Suite (ZCS) | 0 – before 10.1.21 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories vendor-advisory