A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute… (CVE-2026-93638)

CVE-2026-93638 is a reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) affecting versions 10.1.16 and 10.1.17. The issue occurs because the zrememberme parameter is inserted into a hidden input attribute without proper HTML encoding when a crafted relogin URL triggers a two-factor error display. This enables an unauthenticated attacker to execute arbitrary JavaScript in the victim's browser under the legitimate Zimbra origin. The attack can be used to capture credentials by presenting a fake login form. The relogin path logs out any existing session before rendering the malicious content, so the attack does not inherit mailbox access from the victim's session.

An unauthenticated attacker can execute arbitrary JavaScript in the context of the Zimbra login page, potentially leading to credential theft via a fake login form. However, the attack does not allow direct access to the victim's mailbox because the relogin path logs out any existing session before displaying the payload. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity) with low complexity and no privileges required, but user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about clicking on suspicious relogin URLs. Administrators should monitor official Zimbra advisories for updates and apply patches promptly once released.