Zimbra Collaboration Suite EUVD-2026-87099

Exploitation requires that the target run the Zimbra Modern (modern UI) web client, and that a recipient be signed in and manually click 'Accept Share' on an attacker-forged share notification - that victim interaction (UI:R) is the primary limiting factor. The attacker themselves needs no authentication or account (PR:N): they only need to be able to deliver a forged share-notification message to the recipient. Impact is confined to users of the Modern client who act on the malicious notification; the classic/legacy client and users who ignore the invite are not affected. Specific vulnerable version ranges are not stated in the provided references.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated stored XSS with scope change and high confidentiality/integrity impact, consistent with the reported 9.3 severity. The one genuine brake is UI:R: exploitation requires a signed-in Zimbra Modern recipient to actively click 'Accept Share', so this is not a fully autonomous remote-code path - it depends on victim interaction. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; the high CVSS is therefore a measure of impact-if-triggered, not of confirmed active use. That said, this signal should not be dismissed: Zimbra webmail is a recurrent, high-value target with a documented history of exploited XSS/webmail flaws, the reporter is Rapid7 (a credible source), and unauthenticated attacker positioning plus account-takeover impact make it a realistic priority for defenders even absent KEV/POC evidence. Net: treat as a high-priority patch item, but note that the absence of EPSS/KEV/POC data means real-world exploitation is currently unconfirmed rather than proven.

An unauthenticated attacker emails a victim organization a forged share-invitation notification containing a malicious XSS payload. When a logged-in user of the Zimbra Modern web client opens it and clicks 'Accept Share', the script executes in their authenticated session, letting the attacker read mailbox contents and perform actions as that user. No public exploit code is identified in the provided data, but the attack requires only a single victim click.