CVE-2026-33368: XSS
Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious JavaScript into a crafted URL. When a victim user accesses the link, the injected script executes in the context of the Zimbra webmail application, which could allow the attacker to perform actions on behalf of the victim.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33368?
The severity of CVE-2026-33368 is classified as high due to its potential for exploitation via reflected cross-site scripting.
How do I fix CVE-2026-33368?
To fix CVE-2026-33368, update your Zimbra Collaboration Suite to the latest patched version recommended by Zimbra.
Who is affected by CVE-2026-33368?
CVE-2026-33368 affects users of Zimbra Collaboration Suite versions 10.0 and 10.1.
What type of vulnerability is CVE-2026-33368?
CVE-2026-33368 is a reflected cross-site scripting (XSS) vulnerability.
Is CVE-2026-33368 exploitable by unauthenticated users?
Yes, CVE-2026-33368 can be exploited by unauthenticated attackers to inject malicious JavaScript.