# CVE-2026-93647: Zimbra Collaboration stored XSS in calendar COUNTER message From address

Source: https://junglewise.ai/threats/cve-2026-93647-an-unauthenticated-calendar-sender-can-place-active-markup-in-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93647 · Severity: critical · CVSS 9.3 · Published 2026-09-25

Zimbra Collaboration's Classic Web Client contains a stored cross-site scripting (XSS) vulnerability in how it handles calendar counter-proposal messages. An unauthenticated attacker can inject malicious script into the sender's From address field, which executes when a user selects the message in their calendar. An attacker exploiting this can steal mailbox data and impersonate the victim in their email sessions.

Vendors: [Zimbra](https://junglewise.ai/threats/vendors/zimbra).

## Quick answers

**Is CVE-2026-93647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93647 being exploited in the wild.

**How severe is CVE-2026-93647?** Critical severity, with a CVSS score of 9.3, published 25 September 2026.

**Which products and versions are affected?** Zimbra Collaboration Server versions prior to 10.1.21.

**Is there a fix for CVE-2026-93647?** A patch was published on 2026: Fixed in Zimbra Collaboration Server 10.1.21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93647 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-93647?** Check whether you run Zimbra Collaboration Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored XSS flaw in Zimbra Classic's calendar COUNTER message handling, specifically in the RFC From address field. An unauthenticated attacker can craft a specially formatted COUNTER message with active markup in the From header; when the victim selects or opens the message, the script executes in their browser session with full access to their mailbox. The vulnerability has been addressed in Zimbra Collaboration Server 10.1.21.

## Affected products

- Zimbra Collaboration Server versions prior to 10.1.21

## Timeline

- 2026-09-25: disclosed
- 2026: patched: Fixed in Zimbra Collaboration Server 10.1.21

## References

- [https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)

## Related threats

- [Zimbra OnlyOffice path traversal and code execution](https://junglewise.ai/threats/cve-2026-93643-when-onlyoffice-document-editing-is-available-an-unauthenticated)