Zimbra Zimbra Collaboration Suite (Zcs)
4 CVEs affecting Zimbra Zimbra Collaboration Suite (Zcs). Latest disclosed: 2026-09-25. Critical: 4, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93643 | Critical | 9.8 | 2026-09-25 | When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsi… |
CVE-2026-93647 | Critical | 9.3 | 2026-09-25 | An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS… |
CVE-2026-93642 | Critical | 9.3 | 2026-09-25 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the at… |
CVE-2026-93641 | Critical | 9.3 | 2026-09-25 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the a… |