CVE-2026-33368: Zimbra Collaboration Suite · Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 6.1 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 20 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2026-33368, organizations should implement the following specific measures: 1) Apply any available patches or updates from Zimbra as soon as they are released, even though no patches are currently listed, monitoring vendor advisories closely. 2) Implement strict input validation and output encoding on the /h/rest endpoint to neutralize malicious scripts, ensuring all user-supplied data is properly sanitized before rendering. 3) Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts within the webmail application. 4) Educate users about the risks of clicking unsolicited or suspicious links, particularly those purporting to be from internal email systems. 5) Monitor web server logs for unusual or suspicious URL requests targeting the /h/rest endpoint to detect potential exploitation attempts. 6) Consider deploying web application firewalls (WAFs) with rules designed to detect and block reflected XSS payloads targeting Zimbra interfaces. 7) Review and restrict browser permissions and session timeouts to minimize the window of opportunity for attackers. 8) Conduct regular security assessments and penetration testing focused on webmail interfaces to identify and remediate similar vulnerabilities proactively.
Description
Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious JavaScript into a crafted URL. When a victim user accesses the link, the injected script executes in the context of the Zimbra webmail application, which could allow the attacker to perform actions on behalf of the victim.