CVE-2026-93647: Zimbra Classic Stored XSS Vulnerability

CVE-2026-93647 Overview

CVE-2026-93647 is a stored cross-site scripting (XSS) vulnerability in Zimbra Classic. An unauthenticated calendar sender can inject active markup into the RFC From address of a COUNTER iCalendar message. The payload executes when a victim selects the message in Zimbra Classic, giving the attacker access to mailbox data and the ability to act as the victim within the web client session.

The flaw is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation and requires only that the target view the malicious calendar response.

Critical Impact
Unauthenticated attackers can achieve stored XSS in authenticated mailbox sessions, enabling mailbox data theft and account takeover through a single user interaction.

Affected Products

Zimbra Collaboration (Classic web client)
Zimbra calendar component handling iCalendar COUNTER messages
Refer to the Zimbra Security Advisories for the authoritative list of affected builds

Discovery Timeline

2026-09-25 - CVE-2026-93647 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-93647

Vulnerability Analysis

The vulnerability resides in how Zimbra Classic renders the sender information of inbound iCalendar COUNTER messages. The From header field, defined in the relevant RFC, is treated as display text when the message list and preview pane render the counter-proposal. Because the field is not sanitized or encoded before being inserted into the DOM, injected HTML and script tags execute in the context of the victim's authenticated Zimbra session.

Selecting the crafted message in the Classic client is sufficient to trigger execution. The script runs with the privileges of the mailbox owner and can read mail content, access contacts and calendar data, and issue requests to the Zimbra SOAP API on the victim's behalf.

Root Cause

The root cause is improper neutralization of user-controlled input placed in an HTML context [CWE-79]. Zimbra Classic trusts the From address of calendar replies, including COUNTER responses, and omits output encoding when the value flows into the rendered message header. Because the attacker controls the full RFC From string on the sending side, arbitrary active markup reaches the browser.

Attack Vector

The attack vector is network-based and unauthenticated on the sender side. An attacker constructs an iCalendar METHOD:COUNTER message with HTML or script content embedded in the display-name portion of the From address. The message is sent to a target Zimbra mailbox using standard SMTP. When the recipient opens the Classic web client and selects the counter-proposal, the stored payload executes. The scope change reflected in the CVSS vector indicates the script gains access beyond the vulnerable component into the authenticated user session.

No verified proof-of-concept code is published. See the Zimbra Security Advisories for vendor-provided technical details.

Detection Methods for CVE-2026-93647

Indicators of Compromise

Inbound iCalendar messages with METHOD:COUNTER where the RFC From header contains HTML tags, <script>, javascript: URIs, or event-handler attributes such as onerror= and onload=.
Unexpected outbound SOAP requests from Zimbra mailboxes immediately following a user opening a calendar counter-proposal.
Mailbox audit log entries showing bulk read, forward, or filter-rule creation actions originating from the web client without corresponding user activity.

Detection Strategies

Parse inbound SMTP traffic at the mail gateway and flag text/calendar parts whose ORGANIZER or ATTENDEE fields contain angle brackets or script sinks.
Deploy content security monitoring on the Zimbra web tier to alert on inline script execution within mailbox header render contexts.
Correlate mailbox.log and audit.log entries to surface session activity patterns consistent with XSS-driven automation.

Monitoring Recommendations

Enable verbose logging on the Zimbra mailstore and forward logs to a SIEM for retention and correlation.
Monitor for new filter rules, forwarding addresses, and delegated access grants created shortly after calendar message interactions.
Alert on anomalous authentication sessions issuing high volumes of GetMsgRequest or SearchRequest SOAP calls from a single browser session.

How to Mitigate CVE-2026-93647

Immediate Actions Required

Apply the Zimbra security patch referenced in the Zimbra Security Advisories as soon as it is available for your release train.
Direct users to the Modern web client until Classic is patched, as the vulnerability is specific to the Classic interface.
Review mailbox audit logs for suspicious filter rules, forwards, and delegation changes created since the published date.

Patch Information

Zimbra tracks fixes for calendar-handling XSS issues through its wiki-based advisory process. Administrators should consult the Zimbra Security Advisories page for the exact patch version, build hash, and installation instructions corresponding to their deployed release.

Workarounds

Restrict acceptance of inbound iCalendar COUNTER messages at the mail transfer agent until patching is complete.
Instruct users to avoid selecting unexpected calendar counter-proposals in the Classic client and switch to the Modern UI where feasible.
Deploy a web application firewall or reverse-proxy Content Security Policy that blocks inline script execution within the Zimbra Classic origin.

bash

# Example Postfix header_check to quarantine COUNTER messages with HTML in From
# /etc/postfix/header_checks
/^From:.*[<>].*METHOD:COUNTER/ HOLD Suspicious iCalendar COUNTER with markup in From

# Apply with:
postmap /etc/postfix/header_checks
postfix reload