Reflected Cross-Site Scripting Vulnerability in Zimbra Collaboration Suite
CVE-2026-10632

8.7HIGH

Key Information:

Vendor

Zimbra

Status
Zimbra Collaboration Suite
Vendor
CVE Published:
23 October 2026

What is CVE-2026-10632?

A reflected cross-site scripting vulnerability exists within the Classic Web Client of Zimbra Collaboration Suite (ZCS), allowing attackers to inject malicious JavaScript through the 'packages' parameter of the /h/rest document editor. This vulnerability arises from the editor's failure to properly HTML encode package names inserted into script attributes. When this vulnerability is combined with another issue, it enables an attacker with a standard Zimbra account to craft a URL that, when accessed by a different signed-in user, executes the injected JavaScript in their browser session. This results in unauthorized access to mailbox data and the ability to perform actions on behalf of the victim. Affected versions include ZCS 10.1.16, and the issue has been resolved in version 10.1.17.

Affected Version(s)

Zimbra Collaboration Suite 0 < 10.1.17

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
vendor-advisory
https://www.rapid7.com/blog/post/ve-breaking-zimbra-ident...
related

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7
.