CVE-2026-93641— Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
Quick assessment
Affected
Zimbra Zimbra Collaboration Suite (ZCS)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
未经身份验证的攻击者可以伪造一份共享通知，当已登录的 Zimbra Classic 收件人点击“接受共享”时，该通知将触发存储型跨站脚本攻击（XSS）。利用此漏洞，攻击者能够访问受害者的邮箱数据，并以受害者身份执行操作。
Possible ATT&CK Techniques 3 AI
T1530 · Data from Cloud Storage T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Zimbra | Zimbra Collaboration Suite (ZCS) | < 10.1.21 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93641
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
Source: CVE Program / CVE List V5
Vulnerability Description
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Zimbra | Zimbra Collaboration Suite (ZCS) | 0 ~ 10.1.21 | - |
|
II. Public POCs for CVE-2026-93641
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93641
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-93641 (1)
-
Zimbra Security Advisories - Zimbra :: Tech Center vendor-advisory
Same Patch Batch · Zimbra · 2026-09-25 · 4 CVEs total
| CVE-2026-93643 | 9.8 CRITICAL | Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Ex |
| CVE-2026-93642 | 9.3 CRITICAL | Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share |
| CVE-2026-93647 | 9.3 CRITICAL | Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Cale |
IV. Related Vulnerabilities
Same product: Zimbra Collaboration Suite (ZCS)
Same vendor: Zimbra
-
CVE-2026-93647
Zimbra Collaboration Suite Classic Web Client Stored Cross-S -
CVE-2026-93643
Zimbra Collaboration Suite OnlyOffice Integration Path Trave -
CVE-2026-93642
Zimbra Collaboration Suite Modern Web Client Stored Cross-Si -
CVE-2026-73576
Zimbra <10.1.17 OnlyOffice弱密钥生成致JWT伪造 -
CVE-2026-73575
ZCS<10.1.17 CSRF漏洞
Same weakness: CWE-79
-
CVE-2026-103292
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_hea -
CVE-2026-103277
Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEm -
CVE-2026-103249
n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via R -
CVE-2026-7176
Multiple vulnerabilities in Entradium by Crocantickets -
CVE-2026-7175
Multiple vulnerabilities in Entradium by Crocantickets
V. Comments for CVE-2026-93641
No comments yet