EUVD-2026-87102
GHSA-h5jf-rfhh-rx8c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft COUNTER message with markup in From address
-
DeliverySend to victim mailbox unauthenticated
-
ExploitVictim selects message in Zimbra Classic
-
ExecutionStored XSS executes in session
-
ImpactExfiltrate mailbox data and act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to run the Zimbra Classic (legacy) web client and to select/open the malicious message - the modern Zimbra UI is not implicated by the description. The attacker needs no authentication and no valid account: they simply send an iCalendar/iTIP COUNTER (counter-proposal) message with active markup placed in the RFC From address header. The limiting factor is UI:R - the payload only fires when the victim views the crafted message in Classic; it does not self-execute on delivery. No special server configuration is named beyond the Classic interface being in use. |
| Impact | This is a genuinely high-priority issue, not merely a high-CVSS paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3) describes a remote, unauthenticated, low-complexity stored XSS with a scope change and high confidentiality/integrity impact; the only friction is UI:R, satisfied when a victim merely selects a malicious message in the Zimbra Classic web client - a routine action for a mail user, so the interaction barrier is weak. Zimbra is a repeatedly and actively targeted platform (multiple prior Zimbra flaws are in CISA KEV), which raises real-world concern for this class of bug. However, key exploitation signals are ABSENT from the provided data: no EPSS score, no CISA KEV listing, and no public POC are indicated, so current status is 'no public exploit identified at time of analysis.' The A:N is consistent (XSS does not degrade availability). One caveat: the only reference is the generic Zimbra Security Advisories wiki landing page, not a version-specific advisory, so affected/fixed versions cannot be confirmed from the input. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a calendar COUNTER (iTIP counter-proposal) message to a Zimbra user with active HTML/JavaScript markup embedded in the RFC From address. When the victim selects or opens that message in the Zimbra Classic web interface, the script executes in the victim's authenticated session, letting the attacker read mailbox data and perform actions as the victim. No POC is indicated in the provided data; exploitation is network-based and low-complexity but requires the victim to view the message (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Zimbra Collaboration Suite's Classic web client is vulnerable to stored cross-site scripting via iCalendar COUNTER messages, allowing an unauthenticated remote attacker to inject active markup into the RFC From address and execute scripts when a victim selects the message, leading to mailbox data theft and session hijacking. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) yields a 9.3 base score; exploitation requires the victim to use the legacy Classic UI and open the crafted message, while the modern UI is unaffected. No public exploit code has been identified at time of analysis, but the low complexity and high impact warrant urgent remediation.
RemediationAI
No vendor-released patch version is specified in the provided intelligence; administrators should monitor the Zimbra Security Advisories wiki (https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories) for updates and apply the latest patches as soon as they are available. Until a patch is applied, consider migrating users from the Classic web client to the modern UI, which is not affected, or restrict access to the Classic interface. Disabling iCalendar/iTIP processing entirely would break calendar interoperability and is not recommended as a long-term fix. Additional compensating controls include deploying a web application firewall (WAF) to detect and block XSS payloads in calendar messages, and training users to avoid opening unexpected calendar items, though these are not foolproof. Note that the attack requires the victim to select the message, so user awareness can reduce risk, but the primary remediation is to patch promptly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the rendering of iCalendar/iTIP COUNTER (counter-proposal) messages within Zimbra Collaboration Suite's Classic web client. RFC 5545 defines the iCalendar format, and the 'From' address in such messages is intended to identify the sender, but the Classic UI fails to properly sanitize or encode this field before displaying it, leading to CWE-79 (Improper Neutralization of Input During Web Page Generation). An attacker can craft an iTIP COUNTER message with HTML/JavaScript in the RFC From header; when the victim opens the message in the Classic interface, the script executes in the context of their authenticated session, bypassing the same-origin policy (Scope:C) and enabling theft of mailbox data and CSRF-style actions as the victim. The CPE cpe:2.3:a:zimbra:zimbra_collaboration_suite_(zcs):* indicates that all versions of ZCS are potentially affected unless patched, and the CVSS vector confirms network exploitability with no privileges required (PR:N) but user interaction (UI:R) necessary. The modern Zimbra web client is not implicated by the description.
Know when Zimbra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Unauthenticated remote sender (PR:N/AV:N/AC:L); victim must view the message (UI:R); XSS in browser context crosses the security authority of the web app (S:C) enabling mailbox theft and acting-as-victim (C:H/I:H, A:N).
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
2DescriptionCVE.org
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
Executive ViewAI
Zimbra Collaboration Suite's Classic web client has a critical stored cross-site scripting vulnerability that an unauthenticated attacker can use to compromise user mailboxes and sessions when a recipient opens a crafted calendar message. Organizations still running the legacy Classic interface are most exposed, and successful exploitation could lead to unauthorized access to sensitive email communications and account takeover. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, so leadership should prioritize interim mitigations and migration to the modern UI.
No vendor-released patch identified at time of analysis; interim mitigations include disabling the Classic web client and enforcing the modern UI, filtering iCalendar COUNTER messages at the email gateway, and monitoring for anomalous session or mailbox activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Remote code execution in Zimbra Collaboration (ZCS) before 10.1.20 enables unauthenticated network attackers to execute
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. Rat
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch
A critical unauthenticated remote code execution vulnerability exists in Zimbra Collaboration Suite PostJournal service
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) be
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). Rated high severity (CVSS 7.8), this
Unspecified vulnerability in Zimbra Collaboration Server 7.2.5 and earlier, and 8.0.x through 8.0.5, has "critical" impa
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated medium severity (CVSS 6.1), this vulnerability
Unauthenticated remote attackers who can reach an existing publicly shared Briefcase document can abuse unsigned save fi
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preaut
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sen
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove
Exploit-DB