# CVE-2026-93641: Zimbra Collaboration stored XSS in share notifications

Source: https://junglewise.ai/threats/cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93641 · Severity: critical · CVSS 9.3 · Published 2026-09-25

Zimbra Collaboration, an email and messaging platform used by enterprises, contains a stored cross-site scripting vulnerability in its share notification feature. An unauthenticated attacker can craft a forged share notification that executes malicious JavaScript when a signed-in user clicks "Accept Share", allowing the attacker to steal mailbox data and perform actions as the victim user.

Technologies: [Zimbra Collaboration](https://junglewise.ai/threats/technologies/collaboration). Vendors: [Zimbra](https://junglewise.ai/threats/vendors/zimbra).

## Quick answers

**Is CVE-2026-93641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93641 being exploited in the wild.

**How severe is CVE-2026-93641?** Critical severity, with a CVSS score of 9.3, published 25 September 2026.

**Which products and versions are affected?** Zimbra Collaboration versions prior to 10.1.21.

**Is there a fix for CVE-2026-93641?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93641 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-93641?** Check whether you run Zimbra Collaboration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated attacker can send a crafted share notification that, when accepted by a signed-in Zimbra Classic client recipient, stores and executes malicious JavaScript in the user's session context. The vulnerability exists in the share invitation handling logic of the Classic Web Client and requires only that the target user clicks the Accept Share action on a forged notification. Successful exploitation grants the attacker full access to the victim's mailbox and the ability to perform actions as that user.

## Affected products

- Zimbra Collaboration versions prior to 10.1.21

## Timeline

- 2026-09-25: disclosed

## References

- [https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)

## Related threats

- [Zimbra Collaboration stored XSS in share notifications](https://junglewise.ai/threats/cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that)
- [An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present…](https://junglewise.ai/threats/cve-2025-67809-an-issue-was-discovered-in-zimbra-collaboration-zcs-10-0-and-10-1)
- [Zimbra Collaboration deserialization attack via unspecified vectors](https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified)
- [Zimbra Collaboration integrity vulnerability via unknown vectors](https://junglewise.ai/threats/cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors)
- [Zimbra Collaboration Multiple XSS Vulnerabilities](https://junglewise.ai/threats/cve-2016-3412-zimbra-collaboration-multiple-xss-vulnerabilities)