Zimbra Collaboration Suite CVE-2026-50053

Full exploitation requires: (1) the attacker holds a valid Zimbra authentication token/account to place in the crafted URL; (2) a target running ZCS 10.1.16 where companion CVE-2026-10632 is present, because that is the version/chain the description ties the JavaScript execution to; (3) a signed-in victim who clicks the attacker's crafted /h/* link (UI:R), whose parameters RestFilter copies into servlet attributes (auth token, target account, target item, dispatch state) consumed by the Classic Web Client. Limiting factors: ZCS 10.1.17 changes the document renderer and blocks this XSS chain (though the request-attribute override primitive itself remains), so patched-to-10.1.17 instances are not exploitable via this XSS path; the victim must be authenticated and must interact; and the attacker must already possess a valid token rather than being fully anonymous.

Signals point to a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7) describes a network-reachable, low-complexity flaw that crosses a security boundary (scope changed) to compromise another user's confidentiality and integrity, but it requires attacker-held privileges (PR:L) and victim interaction (UI:R), which tempers raw severity. Note a tension in the inputs: the description says the request-attribute override itself is reachable by 'unauthenticated requests to /h/*', yet the weaponized end-to-end XSS requires the attacker to supply 'their own valid token' - i.e., the attacker needs a valid Zimbra account, consistent with PR:L; the unauthenticated primitive alone is not the full impact. No EPSS score was provided, so statistical exploitation probability cannot be weighed. The vulnerability is NOT listed in CISA KEV and no SSVC automatable/technical-impact decision data was supplied; the only priority signal is the vuln.today Decision label 'this_week', which aligns with 'patch in the normal urgent cycle' rather than act_now/emergency. Exploitation is further gated: the full JavaScript-execution chain depends on ZCS 10.1.16 combined with CVE-2026-10632, and ZCS 10.1.17 already breaks that chain by changing the document renderer (while leaving the override primitive in place). Overall this is a real, credibly-researched issue in a frequently-targeted product that warrants prompt patching, but its blast radius is constrained by the required valid token, user interaction, and version-specific chaining.

An attacker with a valid Zimbra account crafts a link to /h/* that embeds their own authentication token plus target account, item and dispatch parameters, which RestFilter copies into servlet attributes trusted by the Classic Web Client. On ZCS 10.1.16 (where CVE-2026-10632 is present), luring a signed-in victim to click the link executes attacker-controlled JavaScript inside the victim's authenticated browser session, enabling session/mail theft or actions as the victim. Rapid7 has published a detailed technical writeup of the attack chain, but the input does not confirm packaged, working exploit code.