CVE-2026-93647
CriticalCVSS 9.3Summary
An unauthenticated calendar sender can place active markup in a COUNTER message's From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
Risk Assessment
The attack can lead to mailbox data theft and unauthorized actions on behalf of the victim.
Recommendation
Apply available security patches for Zimbra Classic and consider restricting calendar message processing.
Other vulnerabilities in Zimbra
See all- CVE-2026-93643Critical
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as the zimbra user.
- CVE-2026-93642Critical
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
- CVE-2026-93641Critical
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
Original NVD description (English source)
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS