Reflected Cross-Site Scripting in Zimbra Collaboration Suite
CVE-2026-93638

6.1MEDIUM

Key Information:

Vendor

Zimbra

Status
Zimbra Collaboration Suite
Vendor
CVE Published:
23 October 2026

What is CVE-2026-93638?

A reflected cross-site scripting vulnerability exists in the login page of Zimbra Collaboration Suite, enabling attackers to execute malicious JavaScript via the zrememberme parameter. By crafting a specific relogin URL, an unauthenticated user can manipulate the input attribute without proper HTML encoding. Users opening this malicious URL receive scripts controlled by the attacker under the trusted Zimbra domain, potentially leading to the theft of credentials through a fake login form. This attack can circumvent existing sessions by logging out users before executing the payload, ensuring that no mailbox access from prior sessions is inherited.

Affected Version(s)

Zimbra Collaboration Suite 0 <= 10.1.17

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
vendor-advisory
https://www.rapid7.com/blog/post/ve-breaking-zimbra-ident...
related

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7
.