CVE-2026-93642 in Collaboration Suite

Resumen

por MITRE • 2026-09-25

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsable: Rapid7
• Reservar: 2026-09-18
• Divulgación: 2026-09-25
• Moderación: aceptado
• Artículo: VDB-410270
• CPE: listo
• CWE: CWE-79 (confirmado)
• CVSS: 9.3 (CNA)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo
• Sector: Education, Lawfirm, ...

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-93642
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93642
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-93642/