# Zimbra Collaboration patches two stored XSS bugs

Published: 2026-10-29 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/790496c7-3bb3-5fee-9b71-2ec07a07b620/zimbra-collaboration-patches-two-stored-xss-bugs
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT Polska discloses two stored XSS vulnerabilities in Zimbra Collaboration pre-10.1.21, exploitable via crafted email headers to hijack victim sessions.

Source: cert.pl — https://cert.pl/en/posts/2026/10/CVE-2026-66911

## What to check

- Applies to: The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska, together with independent researcher Suraj Disoja of TrustFoundry, disclosed two stored cross-site scripting vulnerabilities in Synacor's Zimbra Collaboration software affecting all versions prior to 10.1.21. Both issues stem from insufficient sanitization of email header content rendered in the Zimbra web interface.

CVE-2026-66911 involves the Content-Location MIME header in email attachments: an unauthenticated attacker can set this header to a javascript: URI, and when a victim opens the email in Zimbra's web interface and clicks the attachment name, the payload executes in the victim's browser context. CVE-2026-66912 affects the From header during HTML reply composition in Classic UI — a crafted From header with an embedded JavaScript payload executes when a victim opens the message, enables HTML mode with reply headers disabled, and clicks Reply. Both flaws allow an attacker to steal session information or perform actions on behalf of the victim.

No evidence of in-the-wild exploitation is mentioned in the advisory. Both vulnerabilities were fixed in Zimbra Collaboration 10.1.21. Defenders running Zimbra should upgrade to 10.1.21 or later; detection should focus on inbound emails with unusual Content-Location or From header values containing javascript: URIs or embedded script tags.

## Mentioned in this report

- Vulnerabilities: CVE-2026-66911, CVE-2026-66912

Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-66911

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/790496c7-3bb3-5fee-9b71-2ec07a07b620/zimbra-collaboration-patches-two-stored-xss-bugs.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup