CVE-2026-93638: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Zimbra Zimbra Collaboration Suite

CVE-2026-93638 is a reflected cross-site scripting vulnerability in Zimbra Collaboration Suite's login page. The vulnerability is due to improper input neutralization of the zrememberme parameter, which is embedded in a hidden input field without proper HTML encoding during a two-factor authentication error display. An unauthenticated attacker can craft a malicious relogin URL that causes victim browsers to execute arbitrary JavaScript within the context of the legitimate Zimbra domain. This enables the attacker to present a fake login form to capture user credentials. The relogin path logs out any existing session before rendering the malicious payload, so the attack does not provide access to the victim's mailbox or session data. Affected versions include all ZCS versions from the initial release up to and including 10.1.17.

The vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the Zimbra Collaboration Suite login page, potentially leading to credential theft via a fake login form. However, the attack does not inherit any existing mailbox session, limiting the impact to credential capture rather than direct mailbox compromise. The CVSS 3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impact with no availability impact.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of suspicious relogin URLs and avoid clicking on untrusted links that could exploit this vulnerability.