CVE-2026-93647

Summary

A cross-site scripting (XSS) vulnerability allows unauthenticated attackers to inject malicious content into a COUNTER message's RFC From address, leading to potential access to victim's mailbox data.

Exploitability

Exploitation is moderately difficult as it requires the attacker to craft a specific COUNTER message and ensure it is selected by the victim. Precondition is that the Zimbra Classic user must open the message.

Blast radius

If exploited, the attacker can access sensitive mailbox data and potentially impersonate the victim, leading to significant data breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the COUNTER message feature in Zimbra Classic until a patch is available.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.