Threat reportVulnerabilityTL-2026-4787
Zimbra Collaboration stored XSS vulnerabilities CVE-2026-66911 and CVE-2026-66912 (fixed in 10.1.21)
Zimbra Collaboration stored XSS vulnerabilities (TL-2026-4787) is a high-severity software vulnerability, first published 2026-10-30. It has no confirmed attribution, affects Synacor Zimbra Collaboration, references 3 CVEs (CVE-2026-66911, CVE-2026-66912, CVE-2026-93642), maps to 6 MITRE ATT&CK techniques (T1059.007, T1114, T1190), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4787
- Threat ID
- TL-2026-4787
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, enterprise, education, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Zimbra Collaboration stored XSS vulnerabilities
Malware and tooling: Zimbra
How Zimbra Collaboration stored XSS vulnerabilities works
CERT Polska disclosed two stored cross-site scripting flaws (CWE-79) in Synacor Zimbra Collaboration, all versions before 10.1.21. CVE-2026-66911 lets an unauthenticated remote attacker send a crafted email whose unsanitized Content-Location MIME header executes JavaScript when the victim clicks an attachment; CVE-2026-66912 stems from an unsanitized From header when composing an HTML reply in the Classic UI.
On 2026-10-29 CERT Polska published advisories for two stored cross-site scripting vulnerabilities (CWE-79) in Synacor Zimbra Collaboration. Both affect all versions before 10.1.21 and are fixed in 10.1.21. CVE-2026-66911 and CVE-2026-66912 were found through CERT Polska's own research; Suraj Disoja (TrustFoundry) independently discovered and responsibly reported CVE-2026-66911.
CVE-2026-66911: the Zimbra web interface does not sanitize the Content-Location MIME header of email attachments. An attacker can set this header to a javascript: URI in a crafted email. When the recipient clicks the attachment name in the web interface, the attacker-supplied script executes in the context of the victim's authenticated Zimbra session. Per the advisory the attacker is unauthenticated and remote; the only required victim interaction is clicking the attachment.
CVE-2026-66912: the From email header is insufficiently sanitized when a user composes an HTML reply in the Classic UI. A message with a malicious From header injects JavaScript that executes when the victim replies to it in HTML mode.
The sources do not state a CVSS score, vector, in-the-wild exploitation, CISA KEV listing, public proof-of-concept code, or any network or file IOCs. Severity HIGH is an analyst assignment based on the unauthenticated network vector against a widely deployed mail platform, not a figure from the source. Script execution in a webmail session typically exposes mailbox content and session context, but the source does not describe specific post-exploitation behavior; defenders should treat that as a plausible impact rather than an observed one. No BeaconBeagle lookup was applicable because there are no network IOCs. Remediation is to upgrade to Zimbra 10.1.21 or later; detection should focus on inbound messages with Content-Location headers using javascript: schemes and From headers containing markup or script content.
MITRE ATT&CK techniques used in TL-2026-4787
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1204 User Execution
Collection
Initial Access
T1190 Exploit Public-Facing Application; T1566 Phishing
Credential Access
Affected products and versions in Zimbra Collaboration stored XSS vulnerabilities
- Synacor — Zimbra Collaboration
Vulnerable versions: all versions before 10.1.21
Fixed in: 10.1.21
Remediation for Zimbra Collaboration stored XSS vulnerabilities
Patches
- Zimbra Collaboration 10.1.21 (fixes CVE-2026-66911 and CVE-2026-66912)
Immediate actions
- Upgrade Zimbra Collaboration to version 10.1.21 or later
- Inspect inbound mail gateway logs for messages carrying a Content-Location MIME header with a javascript: URI
- Inspect inbound mail for From headers containing HTML or script markup
Workarounds
- Filter or quarantine inbound messages whose Content-Location header uses a javascript: scheme at the mail gateway
- Advise users not to click attachment names in suspicious messages and not to reply in HTML mode to untrusted senders until patched
Longer-term hardening
- Apply a restrictive Content-Security-Policy on the Zimbra web client where supported
- Subscribe to Zimbra security advisories and patch the web client promptly after each release
CVEs associated with Zimbra Collaboration stored XSS vulnerabilities
Weaknesses (CWE) in Zimbra Collaboration stored XSS vulnerabilities
Timeline of Zimbra Collaboration stored XSS vulnerabilities
- ZCS 10.1.20 security notes list fixes for multiple stored XSS issues in the Classic Web Client plus SNMP command injection, a mail-forwarding restriction bypass, mailbox-delegation authorization issues and a Nextcloud-integration SSRF (CVE IDs largely TBD on the Security Center); the XSS class in the Classic UI had already been a recurring fix area
- Zimbra ZCS 10.1.20, the latest release documented on the Zimbra Security Center before the fix, is released; it remains in the affected range (all versions before 10.1.21)
- Advisory credits CERT Polska's own research for both CVEs and Suraj Disoja (TrustFoundry) as independent discoverer of CVE-2026-66911; discovery and report dates are not stated
- Advisory documents CVE-2026-66912 trigger: victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, rendering the unsanitized From header as HTML and enabling JavaScript execution and potential session hijacking
- Zimbra Collaboration 10.1.21 is listed as the fixed version for both vulnerabilities
- CVE-2026-66911 (Content-Location header XSS) and CVE-2026-66912 (From header XSS in Classic UI HTML reply) are published
- CERT Polska publishes its advisory 'Vulnerabilities in Zimbra Collaboration software' covering CVE-2026-66911 and CVE-2026-66912
- Zimbra Security Center page reviewed on 2026-10-30 still lists ZCS 10.1.20 as the latest documented release and contains no entry for 10.1.21 or either CVE; vendor release notes for the fix were not yet available
Sources cited for Zimbra Collaboration stored XSS vulnerabilities
- Vulnerabilities in Zimbra Collaboration software (CERT Polska)
- NVD - CVE-2026-66911
- NVD - CVE-2026-66912
- Zimbra Security Center
- CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
- SOCRadar CVE Radar - CVE-2026-93642 (related Zimbra XSS also fixed before 10.1.21)
- Update Now: Critical Zimbra Classic Web Client Flaw Could Expose Mailboxes (related prior Zimbra XSS)
Detection coverage for TL-2026-4787
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4787 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.