Skip to content

CVE record · 2 sources

CVE-2026-66912

CVSS 5.3

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI.

Vendor: Zimbra
Product: Zimbra Collaboration
CVSS v4.0: 5.3 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-79
Exposure class: Email

Coverage

2

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

33

Advisory CERT Polska 2d ago

Vulnerabilities in Zimbra Collaboration software

During its own research, CERT Polska has found 2 XSS vulnerabilities (CVE-2026-66911 and CVE-2026-66912) in Zimbra Collaboration software.

CVE-2026-66911 CVE-2026-66912 Zimbra
26

CVE NVD 2d ago

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI.

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted…

CVSS 5.3 Fix available CVE-2026-66912 Zimbra