CVE-2026-93647 Zimbra CVE debrief

Who should care

Defenders responsible for Zimbra Classic deployments, security teams monitoring for suspicious activity, and administrators of mailbox data access logs should be aware of this vulnerability and take necessary actions to verify and mitigate it.

Why it matters

This vulnerability allows an unauthenticated attacker to trigger stored XSS in Zimbra Classic, potentially leading to access to sensitive mailbox data and actions as the victim. Defenders should prioritize verification and mitigation, especially those responsible for Zimbra Classic deployments.

• Access to sensitive mailbox data
• Potential for attacker to act as victim
• Need for compensating controls and monitoring
• Verification of Zimbra Classic deployments required

Technical summary

The vulnerability allows an unauthenticated calendar sender to place active markup in a COUNTER message's RFC From address. When a user selects the message in Zimbra Classic, the markup is triggered, allowing the attacker to access mailbox data and act as the victim.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially those responsible for Zimbra Classic deployments.

Recommended defensive actions

• Verify Zimbra Classic deployments for vulnerability exposure
• Implement compensating controls to detect and prevent exploitation
• Monitor for suspicious activity and update mailbox data access logs
• Consider upgrading to a non-classic version of Zimbra if possible

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information from the vendor and other sources is limited. The vulnerability has been confirmed in Zimbra Classic, but the scope of affected deployments and specific exploitation attempts are not well-documented. Defenders should verify Zimbra Classic deployments for vulnerability exposure and implement compensating controls to detect and prevent exploitation. The CVE Program and NVD entries provide source

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.