CVE-2026-93641
CriticalCVSS 9.3Summary
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
Risk Assessment
The attack can lead to mailbox data theft and unauthorized actions on behalf of the victim.
Recommendation
Apply available security patches for Zimbra Classic and consider validating share notifications.
Other vulnerabilities in Zimbra
See all- CVE-2026-93647Critical
An unauthenticated calendar sender can place active markup in a COUNTER message's From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
- CVE-2026-93643Critical
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as the zimbra user.
- CVE-2026-93642Critical
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
Original NVD description (English source)
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS