CVE-2026-93638

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form. The relogin path logs out an existing session before rendering the payload, so the demonstrated attack does not inherit that session's mailbox access. ZCS 10.1.16 and 10.1.17 are affected.

• CWE-79

• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
• https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/Exploit, Third Party Advisory

Published

Oct 23, 2026

Last Modified

Oct 28, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93631A cross-site request forgery vulnerability in the OAuth exte…7.1
• CVE-2026-93633A CSS sanitization vulnerability in Zimbra Collaboration Sui…5.4
• CVE-2026-93634A cross-account authorization vulnerability in Zimbra Collab…4.3
• CVE-2026-93635LDAP filter injection in Zimbra Collaboration Suite 10.1.0 t…5.3
• CVE-2026-93636An LDAP filter injection vulnerability in Zimbra Collaborati…4.3
• CVE-2026-93637An authentication rate-limit bypass in Zimbra Collaboration …3.7
• CVE-2026-93639A missing authorization vulnerability in Zimbra Collaboratio…8.7
• CVE-2026-9364A flaw has been found in projectworlds Online Art Gallery Sh…7.3
• CVE-2026-93640A local privilege escalation vulnerability in the optional d…7.8
• CVE-2026-93641An unauthenticated sender can forge a share notification tha…9.3
• CVE-2026-93642An unauthenticated sender can forge a share notification tha…9.3
• CVE-2026-93643When OnlyOffice/Document Editing is available, an unauthenti…9.8