Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-93641 (primary) + CVE-2026-93642, CVE-2026-93647 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-25 |
| Vendor | Zimbra |
| Product | Collaboration Suite |
| CVSS Score | 9.3 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Consolidated entry. This alert covers 3 stored XSS vulnerabilities in the Zimbra web client, published together in Zimbra Security Advisories. The same update fixes all of them. CVE-2026-93643 (command execution via the OnlyOffice integration) has its own alert.
Vulnerability Description
- CVE-2026-93641 (9.3) — an unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share.
- CVE-2026-93642 (9.3) — the same mechanism in the Zimbra Modern client: a forged share notification triggers stored XSS when the recipient clicks Accept Share.
- CVE-2026-93647 (9.3) — an unauthenticated calendar sender can place active markup in a COUNTER message’s RFC From address. Simply selecting the message in Zimbra Classic triggers stored XSS.
In all three cases the attacker can access mailbox data and act as the victim. Sending an email is enough — the sender needs no account on the server.
Required Actions
Install the latest Zimbra patch published in Zimbra Security Advisories for your release line. Until patched, warn users not to accept unexpected shares and consider filtering messages with unusual content in the From header at the mail gateway. After patching, review mailbox forwarding rules and filters (a typical trace of XSS-based account takeover) and active user sessions.
Who Is Affected?
These vulnerabilities affect Zimbra Collaboration Suite mail servers — both the Classic and Modern web clients. Zimbra is widely used in public administration, universities and companies running their own email; XSS flaws in Zimbra have previously been exploited in espionage campaigns targeting European institutions.
Sources
- NVD - CVE-2026-93641
- NVD - CVE-2026-93642
- NVD - CVE-2026-93647
- Zimbra Security Advisories
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
