CVE-2026-93647

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite (affected versions not specified)

Description An unauthenticated calendar sender can inject active markup into the RFC From address of a COUNTER message. When a user selects this message in Zimbra Classic, it triggers stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server, allowing the attacker to access mailbox data and perform actions on behalf of the victim.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.