CVE-2026-93647 PUBLISHED

Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

Assigner: rapid7
Reserved: 18.09.2026 Published: 25.09.2026 Updated: 25.09.2026

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS Score: 9.3

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Zimbra
Product	Zimbra Collaboration Suite (ZCS)
Versions	Default: unaffected affected from 0 to 10.1.21 (excl.)

Credits

Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7 finder

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Problem Types

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE