CVE-2026-10632 Zimbra CVE debrief

Who should care

Defenders responsible for Zimbra Collaboration Suite deployments, particularly those managing Classic Web Client instances, should assess exposure and apply patches or mitigations as necessary. This includes verifying system configurations, monitoring for suspicious activity, and ensuring that compensating controls are in place for exposed systems. Security teams and vulnerability management teams should prioritize this vulnerability due to its potential

Why it matters

Defenders should prioritize verifying exposure of Zimbra Collaboration Suite Classic Web Client to this vulnerability and apply patches or mitigations as necessary to prevent reading mailbox data and performing authenticated actions as the victim.

• Reading mailbox data as the victim
• Performing authenticated actions as the victim
• Executing JavaScript in another user's Zimbra browser session

Technical summary

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding, enabling an attacker to execute JavaScript in another signed-in user's Zimbra browser session when combined with CVE-2026-50053. This issue affects ZCS 10.1.16 and was remediated in 10.1.17, highlighting the need for defenders to assess exposure and apply patches or mitigations.

Defensive priority

Defenders should prioritize verifying exposure of Zimbra Collaboration Suite Classic Web Client to this vulnerability and apply patches or mitigations as necessary.

Recommended defensive actions

• Verify exposure of Zimbra Collaboration Suite Classic Web Client to this vulnerability
• Apply patches or mitigations as necessary
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the affected version of Zimbra Collaboration Suite. Defenders should verify the exposure of Zimbra Collaboration Suite Classic Web Client to this vulnerability, considering the limited source detail and potential for additional affected versions or configurations. Verification tasks should include reviewing the vendor advisory, assessing system configurations, and monitoring for suspicious activity related to the /h/rest document editor and packages.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.