# Zimbra Collaboration stored XSS vulnerabilities CVE-2026-66911 and CVE-2026-66912 (fixed in 10.1.21)

> CERT Polska disclosed two stored cross-site scripting flaws (CWE-79) in Synacor Zimbra Collaboration, all versions before 10.1.21. CVE-2026-66911 lets an unauthenticated remote attacker send a crafted email whose unsanitized Content-Location MIME header executes JavaScript when the victim clicks an attachment; CVE-2026-66912 stems from an unsanitized From header when composing an HTML reply in the Classic UI.

- **Published:** 2026-10-30T01:04:49Z
- **Last reviewed:** 2026-10-30T01:04:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4787
- **ID:** TL-2026-4787
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-66911, CVE-2026-66912, CVE-2026-93642

## Description

On 2026-10-29 CERT Polska published advisories for two stored cross-site scripting vulnerabilities (CWE-79) in Synacor Zimbra Collaboration. Both affect all versions before 10.1.21 and are fixed in 10.1.21. CVE-2026-66911 and CVE-2026-66912 were found through CERT Polska's own research; Suraj Disoja (TrustFoundry) independently discovered and responsibly reported CVE-2026-66911.

CVE-2026-66911: the Zimbra web interface does not sanitize the Content-Location MIME header of email attachments. An attacker can set this header to a javascript: URI in a crafted email. When the recipient clicks the attachment name in the web interface, the attacker-supplied script executes in the context of the victim's authenticated Zimbra session. Per the advisory the attacker is unauthenticated and remote; the only required victim interaction is clicking the attachment.

CVE-2026-66912: the From email header is insufficiently sanitized when a user composes an HTML reply in the Classic UI. A message with a malicious From header injects JavaScript that executes when the victim replies to it in HTML mode.

The sources do not state a CVSS score, vector, in-the-wild exploitation, CISA KEV listing, public proof-of-concept code, or any network or file IOCs. Severity HIGH is an analyst assignment based on the unauthenticated network vector against a widely deployed mail platform, not a figure from the source. Script execution in a webmail session typically exposes mailbox content and session context, but the source does not describe specific post-exploitation behavior; defenders should treat that as a plausible impact rather than an observed one. No BeaconBeagle lookup was applicable because there are no network IOCs. Remediation is to upgrade to Zimbra 10.1.21 or later; detection should focus on inbound messages with Content-Location headers using javascript: schemes and From headers containing markup or script content.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1204 User Execution
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1114 Email Collection
- T1539 Steal Web Session Cookie

## Sources

- [Vulnerabilities in Zimbra Collaboration software (CERT Polska)](https://cert.pl/en/posts/2026/10/CVE-2026-66911/)
- [NVD - CVE-2026-66911](https://nvd.nist.gov/vuln/detail/CVE-2026-66911)
- [NVD - CVE-2026-66912](https://nvd.nist.gov/vuln/detail/CVE-2026-66912)
- [Zimbra Security Center](https://wiki.zimbra.com/wiki/Security_Center)
- [CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)](https://cwe.mitre.org/data/definitions/79.html)
- [SOCRadar CVE Radar - CVE-2026-93642 (related Zimbra XSS also fixed before 10.1.21)](https://socradar.io/free-tools/cve-radar/CVE-2026-93642)
- [Update Now: Critical Zimbra Classic Web Client Flaw Could Expose Mailboxes (related prior Zimbra XSS)](https://securityaffairs.com/195130/hacking/update-now-critical-zimbra-classic-web-client-flaw-could-expose-mailboxes.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4787