Zimbra Collaboration Suite CVE-2026-93638

Exploitation requires a victim to open an attacker-crafted Zimbra 'relogin' URL in which the zrememberme parameter is set so the page selects the two-factor error display; that error path inserts the parameter value into a hidden input attribute without HTML encoding, reflecting attacker script under the legitimate Zimbra origin. Confirmed affected: ZCS 10.1.16 and 10.1.17 (EUVD: ≤10.1.17). Limiting factors: the attack is unauthenticated but strictly requires user interaction (the victim must open the crafted URL), so it depends on successful phishing/delivery; and the relogin path logs out any existing session before rendering the payload, meaning the demonstrated attack does not inherit the victim's authenticated mailbox access and is primarily useful for credential capture via a fake login form rather than direct session hijacking.

This is a medium-severity (CVSS 6.1) reflected XSS whose real-world risk is moderate and conditional rather than urgent. The CVSS vector (AV:N/AC:L/PR:N) shows network-reachable, low-complexity, unauthenticated triggering, but UI:R is the decisive limiter: the victim must open an attacker-crafted relogin URL, making this a phishing/social-engineering dependent attack rather than a self-propagating one. The S:C scope change with C:L/I:L reflects script execution under the legitimate Zimbra origin enabling credential capture, but the description explicitly notes the relogin path logs out the existing session before rendering the payload, so the demonstrated attack does NOT inherit mailbox access - this materially caps impact versus a typical session-stealing XSS. This is not in CISA KEV (no confirmed active exploitation) and no EPSS score was provided in the input, so widespread automated exploitation cannot be inferred; the Rapid7 research blog reference indicates a public technical writeup/PoC reference exists but it is not verified as working, drop-in exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a credible, documented, but interaction-gated credential-phishing issue. Net: a real, patch-this-cycle item for Zimbra operators - not a drop-everything emergency, and not a high-CVSS-but-no-mechanism paper finding, since the mechanism (unencoded zrememberme in a hidden input via the two-factor error display) is concretely described by the reporter.

An attacker crafts a Zimbra relogin URL containing a malicious zrememberme value that selects the two-factor error display, injecting unencoded script into a hidden input attribute, and sends it to a target via email or chat. When the victim opens the link, attacker-controlled JavaScript runs under the legitimate Zimbra origin and renders a replacement login form that captures the credentials the victim types. A public technical writeup (Rapid7) describing the flaw exists; it is not verified as working, ready-to-run exploit code.