CVE-2026-93641

Executive Summary

CVE-2026-93641 is a stored cross-site scripting (XSS) vulnerability in the Zimbra Classic web client that is triggered when a signed-in recipient clicks "Accept Share" on a forged share notification. The flaw is exploitable by an unauthenticated sender, requires user interaction, and permits the attacker to access mailbox data and act as the victim within the Zimbra session context. With a CVSS 3.1 base score of 9.3 (scope-changed, high confidentiality and integrity impact) and no vendor patch or public exploit evidence available, organizations running the Zimbra Classic client should treat this as a high-priority, internet-facing risk.

Technical Analysis

CVE-2026-93641 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., cross-site scripting). The NVD description states that an unauthenticated sender can forge a share notification such that stored XSS executes when a signed-in Zimbra Classic recipient clicks the "Accept Share" action. The core issue is that attacker-controlled content contained in a share notification is persisted server-side (the "stored" nature of the XSS) and is later rendered into the victim's browser session without adequate output encoding or sanitization at the point where the "Accept Share" interaction occurs.

The vulnerability class characteristics are well understood:

• Injection vector: The share notification is a mail/calendar-style sharing artifact received from a sender. Because the attacker is unauthenticated, the injection point does not require valid credentials — the attacker need only be able to deliver a crafted share notification to the target mailbox.
• Persistence: Because the malicious payload is stored rather than reflected, it survives delivery and is rendered at the time the victim interacts with the notification. This raises the reliability of exploitation versus reflected XSS and does not require the victim to click an attacker-supplied link in the traditional sense.
• Trigger: The single required user action is clicking "Accept Share" in the Zimbra Classic UI. The CVSS vector reflects this with UI:R (User Interaction: Required).
• Scope change: The S:C (Scope: Changed) subscore indicates the vulnerable component's security context is affected in a way that impacts resources beyond its original authorization scope — consistent with script execution in the context of the authenticated Zimbra session and access to mailbox data.

The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N maps as follows: network-exploitable, low attack complexity, no privileges required by the attacker, user interaction required, scope changed, high confidentiality impact, high integrity impact, and no direct availability impact. The confidentiality and integrity highs are consistent with script execution enabling reading of mailbox data and performing actions on behalf of the victim. The absence of an availability impact suggests the technique does not reliably destroy or deny access to data, though destructive follow-on actions performed as the victim remain possible at the application layer.

No specific function names, endpoint paths, DOM sinks, parameter names, or affected Zimbra versions are provided in the source data. Accordingly, this report does not speculate about internal implementation identifiers. The precise injection point within the share-handling code path is not documented in the available intelligence.

Exploitation Scenarios

The following attack chain is derived strictly from the vulnerability class (stored XSS) and the NVD description. No public PoC is available; the chain is inferred from the vulnerability class and the described behavior.

1. Reconnaissance / target identification. The attacker identifies a Zimbra deployment and a target user who uses the Zimbra Classic web client. The attacker does not need credentials on the Zimbra server (PR:N), only the ability to send a share notification to the victim's address — a condition satisfied by any external mail sender that can reach the organization's Zimbra mail flow.

2. Triggering the flaw class. The attacker crafts a share notification containing a JavaScript payload in the attacker-controlled content of that notification. The unauthenticated nature of the sender means the payload is not gated behind authentication. Because the XSS is stored, the payload is persisted as part of the notification artifact rather than being executed at read time on a per-request basis.

3. Payload/execution method (class-level). The victim, signed into Zimbra Classic, clicks "Accept Share" on the forged notification. At that moment the stored, unencoded content is rendered into the authenticated DOM/session context and the JavaScript executes under the Zimbra origin. The exact DOM sink and encoding failure are not documented in the source data; the class-level mechanism is execution of attacker-supplied script as a result of rendering a forged share notification.

4. Post-exploitation impact. Executing script in the authenticated Zimbra session allows the attacker to read mailbox data and to perform actions as the victim (C:H/I:H, S:C). Typical consequences of authenticated-session XSS include exfiltration of mailbox contents, sending mail as the victim, and retrieving or acting on session-bound data. The description explicitly states the attacker can "access mailbox data and act as the victim."

Impact Assessment

Business impact is high. The vulnerability affects the Zimbra Classic web client and therefore any organization exposing Zimbra to untrusted mail senders while operating Classic-mode clients. Because exploitation requires no attacker authentication and only one victim click, the barrier to entry is low, and the payload can be delivered through ordinary mail flows, bypassing perimeter controls that focus on inbound exploit traffic rather than inbound mail content.

CVSS subscores underscore the severity:

• Confidentiality: High — the attacker can read mailbox data in the victim's session context.
• Integrity: High — the attacker can act as the victim, including state-changing operations available to that user.
• Availability: None — no direct denial-of-service impact is scored.
• Scope: Changed — the impact crosses the vulnerable component's authorization boundary, reaching the user's authenticated session and data.

Blast radius is driven by how widely the Classic client is used and how many users would click "Accept Share" on an unexpected notification. Compromise of one mailbox can serve as a foothold for internal phishing, lateral movement opportunities via mailbox contents, and exfiltration of sensitive communications and attachments. Third parties who communicate with a compromised mailbox may also be exposed through follow-on social engineering sent in the victim's name.

CVE-2026-93641 is not listed in CISA KEV, has no public PoC, no Nuclei template, and no observed exploit code in tracked sources. No threat actor campaign or in-the-wild exploitation evidence is available at the time of writing. The absence of exploit evidence does not reduce urgency given the unpatched status and network-reachable, low-complexity attack path.

Detection Guidance

Sigma Rule

title: Suspicious Accept Share Interaction Preceding Zimbra Stored XSS (CVE-2026-93641)
id: 9b2f4c1e-7a3d-4f5e-b6c7-1d2e3f4a5b6c
status: experimental
description: Detects web requests to the Zimbra Classic client involving share acceptance that may be associated with stored XSS triggered via forged share notifications (CVE-2026-93641).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93641
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1189
  - cve.2026-93641
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'GET'
  selection_uri:
    cs-uri-query|contains:
      - 'AcceptShare'
      - 'acceptShare'
      - 'share'
  selection_status:
    sc-status: 200
  condition: selection_method and selection_uri and selection_status
falsepositives:
  - Legitimate calendar and document share acceptance activity
level: medium

YARA Rule

rule CVE_2026_93641_Zimbra_Stored_XSS_Share
{
    meta:
        description = "Detects forged Zimbra share notification content potentially carrying stored XSS payloads associated with CVE-2026-93641"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93641"
        date = "2026-01-01"
        severity = "high"

    strings:
        $share1 = "Accept Share" nocase
        $share2 = "acceptShare" nocase
        $share3 = "shareNotification" nocase
        $xss1 = "<script" nocase
        $xss2 = "javascript:" nocase
        $xss3 = "onerror=" nocase
        $xss4 = "onload=" nocase
        $xss5 = "document.cookie" nocase
        $zm1 = "Zimbra" nocase

    condition:
        uint32(0) != 0x504b0304 and
        filesize < 5MB and
        (any of ($share*)) and
        (any of ($xss*)) and
        any of ($zm1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93641 Zimbra Classic share notification stored XSS attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"AcceptShare"; nocase; http.uri; content:"%3Cscript"; nocase; sid:202693641; rev:1; reference:cve,2026-93641; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93641; classtype:web-application-attack; metadata:affected_product Zimbra, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2026_01_01;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "GET"
      and url.query : ("*AcceptShare*" or "*acceptShare*") ]
  [ process where event.type == "start" ]

Splunk SPL Query

index=web OR index=proxy sourcetype IN ("access_combined","zscaler","bluecoat")
(http.url="*AcceptShare*" OR http.url="*acceptShare*" OR uri_query="*share*")
| eval suspicious=if(match(http.url, "(?i)(AcceptShare|acceptShare)") AND match(uri_query, "(?i)(<script|javascript:|onerror=|onload=)"),1,0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by http.url, user, dest
| convert ctime(first_seen) ctime(last_seen)
| sort -count

Wazuh OSSEC Rule

<group name="web,cve_2026_93641,">
  <rule id="2026936" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>AcceptShare|acceptShare</url>
    <match>share</match>
    <description>CVE-2026-93641 - Possible Zimbra Classic stored XSS via forged share notification acceptance</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>cve_2026_93641,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No vendor fix, workaround, affected-version enumeration, or OSV package mapping was available from any tracked source. Because no official patch exists, mitigation must be defensive and compensating.

1) Immediate mitigations

• Transition users away from the Zimbra Classic web client to the modern/standard web client where feasible, reducing exposure to the specific "Accept Share" rendering path in Classic.
• Enforce strong Content Security Policy (CSP) on the web client to constrain inline script execution and limit exfiltration channels; CSP is a mitigating, not eliminating, control for stored XSS.
• Deploy inbound mail filtering to inspect share notification content for script-bearing markup and dangerous schemes, and alert on share notifications from external or uncommon senders.
• Train users to treat unexpected share notifications from unknown or unauthenticated senders as suspicious and not to click "Accept Share" without verification.
• Segment and restrict access to the Zimbra web interface so it is not unnecessarily reachable from the public internet.

2) Patch/upgrade steps

• Monitor the Zimbra vendor advisory channels and the NVD entry for CVE-2026-93641 for an official fix. No patch reference currently exists.
• When a fixed version is published, inventory all Zimbra deployments (including Classic-mode clients), stage the upgrade in a test environment, validate share notification handling, and roll out on an accelerated schedule given the 9.3 severity.
• Reassess patch confidence after vendor advisory publication; track the specific fixed build in change management.

3) Long-term hardening

• Adopt an output-encoding and sanitization standard for all user- and sender-supplied content rendered in mail and calendar interfaces.
• Maintain an aggressive client-version deprecation policy so legacy clients such as Classic do not linger on internet-facing deployments.
• Continuously monitor for authenticated-session anomalies (unexpected mailbox reads, outbound mail from users who received share notifications) and correlate with web access logs.
• Subscribe to vendor security advisories and CISA KEV; if exploitation is later observed and the CVE is added to KEV, treat remediation as emergency-change priority.

References

• NVD — CVE-2026-93641: https://nvd.nist.gov/vuln/detail/CVE-2026-93641
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK — T1189 Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-93641 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/