EXPLOIT/ALERT Back to feed

Zimbra Collaboration Suite (ZCS) vulnerability

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

Published 25 Sep 2026Updated 29 Sep 20261 sources
CVSS 9.3
Overview Sources History

What happened

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

Affected versions

Zimbra Collaboration Suite (ZCS): before 10.1.21 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

  • Apply vendor-provided updates or mitigations.
  • Review affected product exposure and access logs.

Public PoC references

No public PoC reference has passed the current publication threshold.

CorrectionsReport an issue