Critical · 9.3 CVE-2026-93647 EUVD-2026-87102GHSA-h5jf-rfhh-rx8c

Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

Published Sep 25, 2026 · Updated Sep 28, 2026 · Assigned by rapid7

Vendor: Zimbra Product: Zimbra Collaboration Suite (ZCS)

Description

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

Affected products

Vendor	Product	Affected	Fixed
Zimbra	Zimbra Collaboration Suite (ZCS)	< 10.1.21	10.1.21

Advisories 1

WID-SEC-2026-3593 Synacor Zimbra: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 29, 2026

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories vendor-advisory