CVE-2026-93641 – Zimbra Collaboration Suite (ZCS)
“One forged message, one click, and an attacker is reading your mail as you. Four Critical holes in Zimbra make email the easiest way into the business.”
This Zimbra Collaboration Suite (ZCS) update fixes four Critical vulnerabilities that let unauthenticated attackers take over user mailboxes or run commands on the server. CVE-2026-93641 has a CVSS score of 9.3, Critical severity, and CVE-2026-93642 has a CVSS score of 9.3, Critical severity. In both, an attacker forges a share notification that triggers stored cross-site scripting when a signed-in Zimbra Classic or Zimbra Modern user clicks Accept Share. CVE-2026-93647 has a CVSS score of 9.3, Critical severity. Here, an attacker places active markup in the From address of a calendar COUNTER message, and the script runs when a Zimbra Classic user selects the message. In each case, the attacker gains access to mailbox data and can act as the victim.
CVE-2026-93643 has a CVSS score of 9.8, Critical severity, and is the most serious flaw in this batch. When OnlyOffice/Document Editing is available, an unauthenticated remote attacker who can reach an existing public Briefcase document can abuse unsigned save fields to write files through path traversal and execute commands as the zimbra user. This turns a shared document into a foothold on the mail server itself.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-79