CVE-2026-93647

Executive Summary

CVE-2026-93647 is a stored cross-site scripting (XSS) vulnerability in Zimbra Classic Web Client affecting the rendering of RFC From addresses in COUNTER (iCalendar meeting counter-proposal) messages. An unauthenticated attacker who can send a crafted calendar message can persist active markup that executes in the victim's browser session when the message is selected, enabling theft of mailbox data and full session impersonation. With a CVSS base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) and no patch, public PoC, or vendor advisory currently available, this represents a high-severity, unmitigated risk for any organization running the Zimbra Classic client.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — "Cross-site Scripting"). Per the NVD description, an unauthenticated calendar sender can place active markup in the RFC From address of a COUNTER message. When the recipient selects the message in Zimbra Classic, the injected markup is rendered and stored XSS is triggered.

Key technical properties derivable from the description:

• Injection point: The From address field of a COUNTER message, which is an iCalendar (RFC 5545/5546) scheduling object representing a counter-proposal to a meeting invitation. This field may carry an email address and/or display name supplied by the remote sender.
• Trigger condition: Rendering occurs when the victim selects the message in Zimbra Classic. This is a user-interaction requirement (reflected in the CVSS vector's UI:R), but it is a low-effort interaction (opening/selecting a received calendar message), not a deliberate click on a malicious link.
• Storage nature: Because COUNTER messages are delivered into the mailbox and the malicious markup persists in the message, the XSS is stored — re-triggering each time the message is viewed rather than requiring a fresh delivery.
• Root cause class: Failure to sanitize/encode the RFC From address (a header-derived, attacker-controlled value) before writing it into a rendered HTML context in the Zimbra Classic UI. The specific sanitization routine, function name, or file path involved is not disclosed in the available data and is not asserted here.

The CVSS vector S:C (Changed scope) indicates the exploited component can affect resources beyond its security scope — consistent with script execution spreading from the message-rendering context into the broader authenticated Zimbra session. The absence of a confidentiality/integrity availability prerequisite (PR:N) confirms an unauthenticated remote sender is sufficient to deliver the payload.

Affected version range, precise component identifiers, and the sanitization code path are not available in the provided intelligence. This analysis is restricted to the vulnerability class and the mechanism stated in the NVD description. No public PoC or exploit code exists at time of writing.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the vulnerability class (stored XSS via unsanitized calendar From address) and the mechanics stated in the NVD description. It does not rely on any fabricated function names or endpoints.

1. Reconnaissance / target identification. The attacker identifies an organization using Zimbra Collaboration with the Classic Web Client, and obtains a victim mailbox address. Because delivery is unauthenticated (PR:N), the sender does not need any credentials or an account on the target system.

2. Triggering the flaw class. The attacker composes an iCalendar COUNTER message (a counter-proposal to a meeting invitation) and places crafted active markup in the RFC From address field. This field is the attacker-controlled input that the application later renders without proper neutralization.

3. Payload/execution (class level). The message is delivered to the victim's mailbox. The payload is inert until the victim selects the COUNTER message in Zimbra Classic. On selection, the Classic client renders the From address into HTML, and the injected markup executes as script within the context of the authenticated Zimbra session. The exact markup used to achieve execution is not disclosed and is not specified here.

4. Post-exploitation impact. Once running in the victim's session, the script "can access mailbox data and act as the victim" (per NVD). This enables reading mailbox contents and performing authenticated actions on the user's behalf. Given S:C, the attacker may leverage the session to reach resources beyond the message view itself.

The principal constraint on the attack is the UI:R interaction requirement — the victim must open/select the message — but no separate link click or password entry is required, keeping overall exploitability high (AC:L, PR:N).

Impact Assessment

• Confidentiality (High, C:H): Script execution in the victim's session allows access to mailbox data.
• Integrity (High, I:H): The attacker can "act as the victim," enabling actions such as sending messages, altering calendar entries, or modifying settings under the victim's identity.
• Availability (None, A:N): The vector assigns no direct availability impact.
• Scope (Changed, S:C): Impact extends beyond the vulnerable message-rendering component.
• Attack complexity (Low) / Privileges (None) / User interaction (Required): Low barrier to delivery; exploitation depends only on the victim selecting the message.

Business impact: Compromise of a mailbox via session-level script execution exposes email content, calendar data, contacts, and any tokens or links present in the mailbox. Acting as the victim can facilitate business email compromise, internal phishing from a trusted account, and lateral movement using data harvested from the mailbox. Because delivery is unauthenticated and the payload is stored, a single malicious calendar message can repeatedly target the mailbox until it is removed.

Blast radius: Any user of the affected Zimbra Classic client who receives and selects a crafted COUNTER message. The full set of affected versions is not published, so the susceptible population cannot be precisely enumerated from the available data.

Detection Guidance

Sigma Rule

title: Zimbra Classic COUNTER Message Stored XSS via RFC From Address
id: 6f3b9c2e-8a41-4d7e-9c1a-9364700000c1
status: experimental
description: Detects access/render events in Zimbra Classic Web Client consistent with selecting a COUNTER message, which may trigger stored XSS in CVE-2026-93647.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93647
author: valtersit.com
date: 2026/01/01
logsource:
  category: web
  product: zimbra
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/service/soap/'
      - '/Calendar'
  selection_action:
    cs-uri-query|contains:
      - 'GetMsg'
      - 'GetCalendarItem'
      - 'Counter'
  filter_markup:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'javascript:'
  condition: selection_endpoint and selection_action and filter_markup
falsepositives:
  - Benign calendar messages containing encoded markup in subjects/addresses
level: high

YARA Rule

rule CVE_2026_93647_Zimbra_Counter_XSS
{
    meta:
        description = "Detects active markup embedded in the From address of an iCalendar COUNTER message targeting Zimbra Classic XSS (CVE-2026-93647)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93647"
        severity = "high"

    strings:
        $method   = "METHOD:COUNTER" ascii nocase
        $from     = "FROM;" ascii nocase
        $script   = "<script" ascii nocase
        $js_uri   = "javascript:" ascii nocase
        $onerr    = "onerror=" ascii nocase
        $onload   = "onload=" ascii nocase

    condition:
        $method and $from and any of ($script, $js_uri, $onerr, $onload)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93647 Zimbra Classic COUNTER message From address XSS attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/service/soap/"; http.request_body; content:"METHOD:COUNTER"; nocase; http.request_body; content:"FROM;"; nocase; http.request_body; content:"<script"; nocase; nocase; sid:9364701; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-93647, confidence Medium; classtype:web-application-attack;)

Elastic Detection

sequence by user.name
  [ network where http.request.method == "POST" and url.path contains "/service/soap/" ]
  [ network where http.request.method == "POST" and
      url.path contains "/service/soap/" and
      request.body : ("METHOD:COUNTER" and "FROM;" and ("<script" or "javascript:" or "onerror=")) ]

Splunk SPL Query

index=web sourcetype=zimbra_access
| search uri_path="/service/soap/*"
| search request_body="*METHOD:COUNTER*" request_body="*FROM;*"
| eval xss_marker=if(match(request_body,"(?i)(<script|javascript:|onerror=|onload=)"),1,0)
| where xss_marker=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="zimbra,web,cve_2026_93647,">
  <rule id="936470" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/service/soap/</field>
    <field name="request_body">METHOD:COUNTER</field>
    <field name="request_body">FROM;</field>
    <field name="request_body">script</field>
    <description>CVE-2026-93647: Possible Zimbra Classic COUNTER message stored XSS (markup in RFC From address).</description>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, fixed version, or workaround has been published for CVE-2026-93647. The steps below are class-appropriate mitigations for a stored XSS in a webmail calendar/COUNTER flow; they are not vendor-confirmed fixes.

1. Immediate mitigations

   • Where operationally feasible, disable or restrict the use of the Zimbra Classic Web Client, or direct users to a client/interface not shown to be affected by this rendering path.
   • Reduce exposure of calendar/COUNTER message processing if your configuration allows restricting automatic external scheduling (COUNTER/CANCEL) handling.
   • Deploy the detection rules above (Sigma/YARA/Suricata/Elastic/Splunk/Wazuh) and alert on markup sequences (<script, javascript:, onerror=, onload=) appearing in calendar message bodies or From fields.
   • Train users not to select unexpected calendar COUNTER messages from unknown senders; note that interaction alone is sufficient to trigger execution.

2. Patch/upgrade steps

   • No patch is available. Monitor the Zimbra security advisories and the NVD entry (CVE-2026-93647) for a fixed release.
   • When a vendor fix is published, upgrade all Collaboration and Web Client components to the fixed version without delay and re-test calendar message rendering.
   • Given S:C and High confidentiality/integrity impact, treat a fix as high priority once available.

3. Long-term hardening

   • Require output encoding/context-aware escaping of all attacker-controlled fields (including RFC header-derived address fields) in the webmail rendering layer.
   • Enforce a strict Content Security Policy (CSP) to reduce the impact of any markup injection that reaches the DOM.
   • Apply defense-in-depth email/calendar filtering that strips or neutralizes active markup in scheduling objects.
   • Segment and monitor administrative and mail infrastructure; ensure session cookies are HttpOnly and Secure to limit script-based session theft.
   • Maintain timely Zimbra patch cadence and continuous CVE monitoring for the collaboration suite.

References

• NVD — CVE-2026-93647: https://nvd.nist.gov/vuln/detail/CVE-2026-93647
• MITRE CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS): https://cwe.mitre.org/data/definitions/79.html
• Zimbra Security Advisories (vendor patch source to monitor — no CVE-2026-93647 entry confirmed at time of writing): https://wiki.zimbra.com/wiki/Security_Center
• FIRST EPSS — no score available for CVE-2026-93647 at time of writing: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-93647 not listed as of this report: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild campaign is known for CVE-2026-93647 at the time of writing.