Zimbra Collaboration Suite EUVD-2026-108961

Exploitation requires the attacker to possess a valid ordinary Zimbra account (PR:L) and the target to be a signed-in Zimbra user who opens an attacker-supplied URL (UI:R) in the Classic Web Client, whose /h/rest document editor inserts the 'packages' parameter into a script attribute without HTML encoding. Practical impact further depends on chaining CVE-2026-50053 so the attacker can supply their own authentication token and document identifiers in the URL. Limiting factors: the need for both a pre-existing attacker account and victim interaction, reliance on the Classic Web Client code path, the dependency on the second (chained) vulnerability, and that the affected version is ZCS 10.1.16 with a fix available in 10.1.17.

The input signals point to a credible, moderately urgent issue rather than a mass-exploitation emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, score 8.7) indicates a network-reachable, low-complexity flaw that nonetheless requires an authenticated attacker account (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that the injected script runs in a different user's authenticated session. The vuln.today Decision label is 'this_week', consistent with a serious but not immediate-action finding. No KEV listing is present, so there is no confirmed active exploitation, and no EPSS score was supplied, so statistical exploitation probability cannot be stated. The vulnerability was disclosed by Rapid7, whose public technical write-up is referenced; this is a public PoC/technical reference, but it is not verified in the input as working, drop-in exploit code. A key dependency is that practical impact relies on chaining with CVE-2026-50053 to supply attacker-controlled authentication tokens and document identifiers - details of that second issue are not provided here and should be verified. Net: a real priority to patch (confirmed fix in 10.1.17), but the authentication and user-interaction requirements, plus the chaining dependency, make this targeted/social-engineering-driven rather than wormable or indiscriminately exploitable.

An attacker who already holds an ordinary Zimbra account crafts a /h/rest document-editor URL whose 'packages' parameter contains JavaScript (inserted into a script attribute without HTML encoding) and, via CVE-2026-50053, embeds their own auth token and document identifiers. They send the link to another signed-in Zimbra user; when the victim opens it, the script executes in the victim's authenticated browser session, allowing the attacker to read mailbox data and perform actions as the victim. A public technical write-up from Rapid7 is referenced, but the input does not confirm it as working exploit code.