CVE-2026-93647: falha crítica em Zimbra Collaboration Suite (ZCS)
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.2%
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
Zimbra · Zimbra Collaboration Suite (ZCS)CVEs relacionadas — Zimbra Collaboration Suite (ZCS)
No mesmo produto, das mais perigosas para as menos.
CVE-2026-93643CRITICALZimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas RequestEPSS 1.0%CVE-2026-93641CRITICALZimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share InvitationEPSS 0.3%CVE-2026-93642CRITICALZimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share InvitationEPSS 0.2%