Zimbra Collaboration Suite EUVD-2026-87098

Exploitation requires the target to be running Zimbra Collaboration Suite (ZCS) 'Classic' webmail and for a signed-in recipient to click the 'Accept Share' action on an attacker-forged share notification (UI:R). The attacker needs no account or authentication (PR:N) and can deliver the forged share notification remotely over the network (AV:N). The limiting factor is the mandatory victim interaction - the stored payload only fires when the recipient accepts the share - and the requirement that the victim uses the Classic web client rather than the modern/Zimbra Modern UI. No special server configuration beyond a default share-notification-enabled ZCS deployment is indicated.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3) describes a network-reachable, low-complexity stored XSS requiring no attacker privileges but one act of victim interaction (clicking 'Accept Share'). The scope change (S:C) and high confidentiality/integrity impact drive the critical score: script executes in the authenticated recipient's webmail session, enabling mailbox data theft and acting as the victim. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so this is currently 'no public exploit identified at time of analysis' - a high-CVSS finding rather than a confirmed-exploited one. However, two contextual signals raise real-world concern beyond the raw numbers: Zimbra has a long history of being actively targeted (multiple prior Zimbra XSS/RCE flaws reached CISA KEV), and the reporter is Rapid7, a credible research org whose disclosures often precede weaponization. The A:N is consistent (XSS does not directly deny service). Net: treat as a priority patch for internet-facing Zimbra webmail despite the absence of confirmed exploitation, because the product class is a frequent target and the only barrier is a single plausible user click on a share-acceptance prompt.

An unauthenticated attacker sends a forged share-notification email to a Zimbra Classic user with a malicious payload embedded in the share metadata. When the signed-in recipient clicks 'Accept Share', the stored script executes in their webmail session, letting the attacker read mailbox contents and perform actions as the victim. No public POC is currently identified, but the low attack complexity means only social engineering of a single click is required.