CVE-2026-10632: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Zimbra Zimbra Collaboration Suite
Description
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.
CVSS v3.1
Score 8.7high
Affected software
Zimbra
Zimbra Collaboration Suite
pkg:maven/com.zimbra/zimbra-collaboration-suiteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-10632) involves improper neutralization of input leading to reflected cross-site scripting in the Classic Web Client of Zimbra Collaboration Suite. Specifically, the packages parameter in the /h/rest document editor is not HTML-encoded before being inserted into script attributes, allowing injection of malicious JavaScript. Exploitation requires an attacker to have an ordinary Zimbra account and can be combined with CVE-2026-50053 to hijack another user's authenticated session by supplying authentication tokens and document identifiers in a crafted URL. The vulnerability affects ZCS versions prior to 10.1.17 and was remediated in 10.1.17.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another signed-in user's browser session, leading to potential mailbox data disclosure and the ability to perform authenticated actions as the victim user. This compromises confidentiality and integrity of user data within Zimbra Collaboration Suite.
Mitigation Recommendations
A fix is available in Zimbra Collaboration Suite version 10.1.17. Users and administrators should upgrade to version 10.1.17 or later to remediate this vulnerability. No additional mitigation steps are specified beyond applying the official patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- rapid7
- Date Reserved
- 2026-06-02T14:57:16.032Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6adb61954d27ba8daa2c43ae
Added to database: 10/23/2026, 13:31:01 UTC
Last enriched: 10/23/2026, 13:45:38 UTC
Last updated: 10/23/2026, 14:16:13 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.