CVE-2026-33368 Details
Description
Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious JavaScript into a crafted URL. When a victim user accesses the link, the injected script executes in the context of the Zimbra webmail application, which could allow the attacker to perform actions on behalf of the victim.
A reflected cross-site scripting vulnerability has been identified in the Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. This vulnerability exists within the Classic Webmail REST interface (/h/rest), where the application fails to adequately sanitize user input. This flaw allows an unauthenticated attacker to inject malicious JavaScript into a crafted URL. When a victim accesses this link, the injected script executes within the context of the Zimbra webmail application, potentially enabling the attacker to perform actions on behalf of the victim.
Users can upgrade to ZCS version 10.1.16 or 10.0.12, both of which include the necessary patch. Instructions for upgrading can be found on the Zimbra website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wiki.zimbra.com/wiki/Security_Center | [email protected] | Release NotesVendor Advisory |
| https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_Fixes | [email protected] | Release Notes |
| https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy | [email protected] | Product |
| https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| synacor zimbra collaboration suite | >= 10.0.0, < 10.1.16 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | New CVE Received | [email protected] |