CVE-2026-93641: falha crítica em Zimbra Collaboration Suite (ZCS)
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.3%
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
Zimbra · Zimbra Collaboration Suite (ZCS)CVEs relacionadas — Zimbra Collaboration Suite (ZCS)
No mesmo produto, das mais perigosas para as menos.
CVE-2026-93643CRITICALZimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas RequestEPSS 1.0%CVE-2026-93647CRITICALZimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From AddressEPSS 0.2%CVE-2026-93642CRITICALZimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share InvitationEPSS 0.2%