Zimbra Collaboration Suite CVE-2026-93639

Exploitation requires an authenticated delegated-administrator account that has no explicit administrative grants plus access to the Zimbra admin SOAP service, which is what makes the otherwise-blocked ConfigureZimletRequest call succeed and overwrite the global Zimlet configuration. Beyond the admin-side step, the browser compromise additionally requires a signed-in user in the default class of service to open an attacker-crafted /service/proxy URL (UI:R), because the injected attacker-controlled domain must be served through the proxy allowlist to execute HTML/JavaScript under Zimbra's origin. Limiting factors that reduce real-world risk: a delegated-admin foothold is prerequisite (not unauthenticated), the impact depends on the default class of service configuration, and the full mailbox-read/authenticated-action impact only lands after a targeted victim clicks the crafted link. Only ZCS 10.1.16 and 10.1.20 are stated as affected.

This is a genuine but conditional priority rather than a drop-everything emergency, and the signals are mostly consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, score 8.7) reflects a network-reachable, low-complexity flaw that nonetheless requires both an authenticated low-privileged actor (PR:L - a delegated administrator) and victim interaction (UI:R), with a scope change (S:C) because the attacker's injected content executes under Zimbra's own origin against a different user's session. The vuln.today decision label is 'this_week', which aligns with a high-but-not-critical, non-emergency posture. KEV status is not present in the input, so there is no confirmation of active exploitation; EPSS is not provided, so exploitation-probability cannot be quantified from this data. The flaw was reported by Rapid7 and a Rapid7 research blog is referenced, so technical detail is public; this raises practical risk even though it is not confirmed weaponized. Net: a real this-week patching priority for Zimbra operators, meaningfully gated by the need for a delegated-admin foothold and user interaction rather than a mass-exploitable unauthenticated bug.

A delegated administrator account that has no explicit administrative grants calls ConfigureZimletRequest over the admin SOAP service to overwrite the global Zimlet configuration, adding an attacker-controlled domain to the proxy allowlist of the default class of service. The attacker then lures a signed-in user in that class to open a crafted /service/proxy URL, causing Zimbra to serve attacker HTML under its own origin so the resulting JavaScript reads the victim's mailbox and performs authenticated actions as that user. A public Rapid7 research reference exists describing the issue; it is not verified as working exploit code.