CVE-2026-93642 in Collaboration Suite

Sumário

de MITRE • 25/09/2026

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsável: Rapid7
• Reservar: 18/09/2026
• Divulgação: 25/09/2026
• Moderação: aceite
• Entrada: VDB-410270
• CPE: pronto
• CWE: CWE-79 (confirmado)
• CVSS: 9.3 (CNA)
• EPSS: 0.00000
• KEV: não
• Atividades: muito baixo
• Sector: Government, Telecommunication, ...

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-93642
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93642
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-93642/