Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-93647

Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rapid7

Description

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zimbra Zimbra Collaboration Suite (ZCS)

Default version status: unaffected

  • 0 to < 10.1.21affected

References