TI-2026-51662 Aliases CVE-2026-73572 GHSA-4644-7rc8-9cw4

Cross-site scripting in Zimbra Collaboration

LOW 27CWE-79Published 2026-08-13 · Updated 2026-08-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that, when previewed by a user, executes arbitrary JavaScript within the victim's browser session. Successful exploitation may allow an attacker to perform unauthorized actions on behalf of the victim user, potentially leading to data exfiltration or unauthorized access to sensitive information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00263 18th percentileScored 2026-11-07

Fix Fixed Collaboration (Zimbra): 10.1.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zimbra	Collaboration	before 10.1.17	10.1.17	Patch available	CNA

Collaboration VendorZimbra Affected before 10.1.17 Fixed in 10.1.17 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:synacor:zimbra_collaboration_suite::::::::	before 10.1.17	Vulnerable	Synacor

cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* Versions before 10.1.17 Vulnerable ·Synacor

Remediation

Fix · CNA Collaboration (Zimbra) Fixed in 10.1.17

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-13
Zimbra Collaboration 10.1.17
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-51664 In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists…Priority LOW 35
- TI-2026-51666 In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation…Priority LOW 29
- TI-2026-51663 Path traversal in Zimbra CollaborationPriority LOW 29
Show all 6 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-73572
2026-10-03 Alias added: GHSA-4644-7rc8-9cw4

References

Advisory 2

TI-2026-51660 OS command injection in Zimbra Collaboration KEVCVSS 3.1HIGH 8.9
TI-2025-40820 Cross-site scripting in Zimbra Collaboration KEVCVSS 3.1HIGH 7.2
TI-2024-18266 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. KEVCVSS 3.1MEDIUM 6.1
TI-2024-30553 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before… CVSS 3.1HIGH 8.8
TI-2022-13998 Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly… CVSS 3.1CRITICAL 9.8
TI-2026-63080 Path traversal in Zimbra Collaboration Suite CVSS 3.1CRITICAL 9.8

See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences