Multiple security vulnerabilities have been identified in Zimbra Collaboration Suite (ZCS), affecting multiple releases of the 10.1 series up to and including version 10.1.21. The vulnerabilities impact authentication, mailbox isolation, web-client security, calendar processing, LDAP queries, OAuth integration, and operating-system privilege boundaries. Successful exploitation may allow attackers to execute JavaScript in authenticated users’ sessions, access or manipulate mailbox data, forge email and calendar actions, exhaust mailbox storage quotas, or escalate privileges from the Zimbra service account to root. Rapid7 reported 17 vulnerabilities, comprising seven high-severity and ten medium-severity issues, with no confirmed active exploitation at the time of disclosure.
CVE-2026-10632 (CVSS 8.7 – High): A reflected cross-site scripting (XSS) vulnerability in the Classic Web Client document editor allows attackers to inject malicious JavaScript through the `packages` parameter due to insufficient HTML encoding. When chained with CVE-2026-50053, it can enable script execution within another user’s authenticated session.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Zimbra Collaboration Suite (ZCS), affecting multiple releases of the 10.1 series up to and including version 10.1.21. The vulnerabilities impact authentication, mailbox isolation, web-client security, calendar processing, LDAP queries, OAuth integration, and operating-system privilege boundaries. Successful exploitation may allow attackers to execute JavaScript in authenticated users’ sessions, access or manipulate mailbox data, forge email and calendar actions, exhaust mailbox storage quotas, or escalate privileges from the Zimbra service account to root. Rapid7 reported 17 vulnerabilities, comprising seven high-severity and ten medium-severity issues, with no confirmed active exploitation at the time of disclosure.
CVE-2026-10632 (CVSS 8.7 – High): A reflected cross-site scripting (XSS) vulnerability in the Classic Web Client document editor allows attackers to inject malicious JavaScript through the `packages` parameter due to insufficient HTML encoding. When chained with CVE-2026-50053, it can enable script execution within another user’s authenticated session.[emaillocker id="1283"]
CVE-2026-50053 (CVSS 8.7 – High): An external control of critical state data vulnerability allows an authenticated attacker to manipulate request attributes, including tokens and document identifiers. When chained with CVE-2026-10632, this can facilitate cross-account session abuse and unauthorized access to user data.
CVE-2026-93639 (CVSS 8.7 – High): A missing-authorization vulnerability allows a delegated administrator to modify global Zimlet configuration without the required administrative permissions. An attacker may abuse proxy allowlist changes to serve malicious content under the Zimbra origin and target authenticated users.
CVE-2026-93640 (CVSS 7.8 – High): Incorrect permission assignment in the optional `dnscache` package allows a user with access to the Zimbra service account to abuse the `zmunbound` wrapper and passwordless `sudo` permissions, potentially reading root-protected files or modifying privileged files to obtain root-level access.
CVE-2026-50057 (CVSS 7.8 – High): Incorrect permission assignment in Postfix administration allows a user with access to the Zimbra service account to manipulate the `daemon_directory` configuration and invoke `postfix set-permissions`, potentially executing a root-level post-installation program.
CVE-2026-50056 (CVSS 7.8 – High): An argument-injection vulnerability in the `zmmailboxdmgr` launcher allows a local attacker to supply malicious JVM arguments during a mailbox service restart, potentially executing commands with root privileges.
CVE-2026-93631 (CVSS 7.1 – High): A cross-site request forgery (CSRF) vulnerability in the Network Edition OAuth callback allows an attacker to associate an external account with a victim’s mailbox. This may expose calendar appointments through bidirectional CalDAV synchronization.
CVE-2026-115786 (CVSS 6.5 – Medium): An incorrect calculation vulnerability in mailbox quota accounting allows an attacker to repeatedly share and revoke documents while leaving quota charges behind. This can exhaust another user’s mailbox quota and prevent incoming email delivery.
CVE-2026-93638 (CVSS 6.1 – Medium): A reflected XSS vulnerability in the login page allows unauthenticated attackers to inject JavaScript through the `zrememberme` parameter during a two-factor authentication relogin error, potentially exposing credentials or enabling unauthorized browser actions.
CVE-2026-93633 (CVSS 5.4 – Medium): A CSS sanitization bypass in Briefcase documents allows attackers to circumvent DefangFilter protections using non-ASCII characters, potentially enabling malicious content to be rendered in the web client.
CVE-2026-93630 (CVSS 4.3 – Medium): A host-validation bypass uses percent-encoded hostnames to evade HTML form-action restrictions, potentially allowing form submissions to an unintended destination.
CVE-2026-93627: An iCalendar processing vulnerability allows unauthenticated email senders to cancel or modify calendar meetings through crafted calendar messages.
CVE-2026-93628: An iCalendar processing vulnerability allows forged attendee replies through null sender identities, potentially manipulating meeting responses and calendar records.
CVE-2026-93629: An iCalendar processing vulnerability allows attackers to introduce spoofed calendar invitations through crafted email messages.
CVE-2026-93634 (CVSS 4.3 – Medium): A vulnerability in `FileSharedWithMeRequest` allows forged shared-file records to be inserted, potentially manipulating shared-file information displayed to users.
CVE-2026-93636 (CVSS 4.3 – Medium): An LDAP filter injection vulnerability in `SearchCalendarResourcesRequest` allows attacker-controlled input to modify LDAP search conditions, potentially affecting calendar-resource searches.
CVE-2026-115785 (CVSS 4.3 – Medium): A CRLF injection vulnerability in data-source test addresses allows attackers to inject line breaks into SMTP-related input, potentially enabling spoofed email messages.
The vulnerabilities affect different ZCS 10.1 releases, with fixes distributed across versions 10.1.17, 10.1.18, 10.1.20, and subsequent security updates. Administrators should upgrade to the latest supported Zimbra release, audit `sudoers` rules on mail transfer agent and mailbox servers, review OAuth-linked accounts and mailbox delegation permissions, and monitor for suspicious calendar modifications, unexpected forwarding rules, and unauthorized administrative configuration changes.
We recommend you to update Zimbra Collaboration Suite to version 10.1.17 or 10.1.20 depending on the affected component.
The following reports contain further technical details:
[/emaillocker]