Live › vulnerability › CVE-2026-93638
Go to dashboardA reflected cross-site scripting flaw in the Zimbra Collaboration Suite login page lets an unauthenticated attacker run JavaScript through the zrememberme parameter in a crafted relogin URL. A victim who opens the link can have a fake login form shown under the real Zimbra origin, which captures their credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Zimbra Collaboration Suite 10.1.16 or 10.1.17 with a reachable web login page are exposed, since the attack needs only a victim to open a crafted link. Installations on other ZCS versions are not listed as affected, and mail servers not exposing the web client can skip it.
No product ranges from the sources yet.
zmcontrol -v on the Zimbra server; versions 10.1.16 and 10.1.17 are affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form. The relogin path logs out an existing session before rendering the payload, so the demonstrated attack does not inherit that session's mailbox access. ZCS 10.1.16 and 10.1.17 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-93638")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.