Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

Why this deserves its current priority

CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Zimbra/Zimbra Collaboration Suite (ZCS) (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Zimbra/Zimbra Collaboration Suite (ZCS).
2. 2Review the reported fix. Update Zimbra/Zimbra Collaboration Suite (ZCS) to 10.1.21 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 25, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 25, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 25, 2026

Sources and claim methodology

• Source referencewiki.zimbra.com

Related CVEs

• Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share InvitationSame zimbra/zimbra collaboration suite (zcs) package
• Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas RequestSame zimbra/zimbra collaboration suite (zcs) package
• Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From AddressSame zimbra/zimbra collaboration suite (zcs) package
• Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributesAlso CWE-79
• Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag NamesAlso CWE-79
• Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline TooltipAlso CWE-79