CVE-2026-93641: Zimbra Classic Stored XSS Vulnerability

CVE-2026-93641 Overview

CVE-2026-93641 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Zimbra Classic. An unauthenticated remote attacker can forge a share notification email that embeds malicious script content. When a signed-in Zimbra Classic recipient clicks Accept Share, the payload executes in the victim's authenticated session context. The attacker then gains access to mailbox data and can act as the victim within the Zimbra web client.

The scope-changing nature of the flaw means code executing in the victim's browser can reach resources beyond the vulnerable component itself. No authentication is required to send the forged notification, which lowers the barrier for mass exploitation campaigns targeting Zimbra deployments.

Critical Impact
An unauthenticated attacker can hijack authenticated Zimbra Classic sessions and exfiltrate mailbox contents after a single victim click on Accept Share.

Affected Products

Zimbra Collaboration Suite — Classic web client
Specific affected versions: Not Available (refer to Zimbra Security Advisories)
Patched versions: Not Available (refer to Zimbra Security Advisories)

Discovery Timeline

2026-09-25 - CVE-2026-93641 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-93641

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the share notification handling path of the Zimbra Classic web client. Share notifications are user-visible objects that the recipient must act on, typically by clicking an Accept Share control. The client renders attacker-controlled content from the notification without sufficient output encoding, which allows script execution inside the authenticated application origin.

Because the delivery vector is an email-style share notification, the attacker does not need an account on the target server. The server accepts and stores the forged notification, then presents it to the recipient. Exploitation requires one user interaction, which is why the attack complexity remains low rather than impossible.

Successful execution runs attacker JavaScript with the privileges of the signed-in user. The script can read mailbox contents, issue requests to Zimbra SOAP endpoints, modify filters or forwarding rules, and perform any action available to the victim's role.

Root Cause

The root cause is missing or insufficient contextual output encoding when the Zimbra Classic client renders fields contained within an inbound share notification. Attacker-supplied data crosses from untrusted input into the HTML or DOM context without sanitization, satisfying the conditions for stored XSS described in [CWE-79].

Attack Vector

The attack is network-based and begins with the attacker sending a crafted share notification to a target Zimbra address. The payload sits in the recipient's mailbox until the user interacts with it. When the victim clicks Accept Share in the Classic client, the embedded script executes in the victim's browser session, inheriting the victim's cookies and tokens. The attacker can then pivot to mailbox read access, impersonation, and persistence through mailbox rules.

Technical details for the specific payload format are not publicly documented. Refer to the Zimbra Security Advisories for vendor-authored technical content.

Detection Methods for CVE-2026-93641

Indicators of Compromise

Inbound share notification messages originating from external or spoofed senders that contain HTML tags, event handlers (onerror, onclick, onload), or <script> elements in share-related fields.
Unexpected creation or modification of mailbox filters, forwarding rules, or delegated access entries shortly after a user accepted a share invitation.
Zimbra SOAP API calls from the web client immediately following an Accept Share action that read large volumes of mail or export mailbox contents.

Detection Strategies

Inspect inbound SMTP traffic and the Zimbra message store for share notification payloads containing script-like constructs or encoded JavaScript.
Correlate Accept Share user actions in Zimbra access logs with subsequent anomalous mailbox API activity from the same session identifier.
Deploy content security policy violation reporting in the Zimbra web client where supported, and alert on blocked inline script execution.

Monitoring Recommendations

Monitor Zimbra mailbox.log and access.log for sequences showing share acceptance followed by rule creation, forwarding configuration, or bulk message reads.
Alert on share notifications sent from senders outside the organization that reference internal distribution lists or executive mailboxes.
Track browser-side errors and CSP reports from the Zimbra Classic client to surface attempted script injection events.

How to Mitigate CVE-2026-93641

Immediate Actions Required

Review the Zimbra Security Advisories page and apply the vendor patch addressing CVE-2026-93641 as soon as the fixed build is identified for your release train.
Advise users to avoid clicking Accept Share on unsolicited share notifications, particularly from external or unknown senders, until patching is confirmed.
Audit mailbox filters, forwarding rules, and delegated access entries for all users who may have interacted with suspicious share notifications.

Patch Information

Zimbra tracks fixes for this issue through the official Zimbra Security Advisories. Administrators should consult the advisory corresponding to CVE-2026-93641 to identify the fixed patch level for their Zimbra Collaboration release and apply it across all mailbox nodes.

Workarounds

Direct users to the Zimbra Modern web client where feasible, since the vulnerability is scoped to the Classic client.
Configure inbound mail filtering to quarantine or strip share notifications that contain HTML markup or scripting constructs in share-related fields.
Restrict share notification acceptance to internal senders by applying SMTP policy or gateway rules, reducing exposure to unauthenticated external forgery.

bash

# Configuration example
# Not Available - refer to the Zimbra Security Advisories for vendor-supplied
# configuration guidance specific to CVE-2026-93641