CVE-2026-66912: Stored Cross-Site Scripting in Zimbra

Published Oct 29, 2026

Updated

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the unsanitized From header content is rendered as HTML and the JavaScript payload executes in the victim's browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim. This issue was fixed in version 10.1.21

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Zimbra to a version that resolves this vulnerability.
Fixed in 10.1.21

Event History

Oct 29, 2026

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users are exposed to this issue?

Users of Zimbra Classic UI are exposed when they open a crafted message, click Reply, compose the reply in HTML mode, and have reply headers disabled. The resulting script executes in the replying user's browser.

What does an attacker need to exploit it?

An attacker only needs to send a crafted email whose From header contains an embedded JavaScript payload. No attacker authentication is described, but the recipient must perform the required reply action in Classic UI.

Are all reply workflows affected?

No. The described vulnerable path requires Classic UI, HTML reply composition, and disabled reply headers. The provided information does not establish impact for other interfaces or composition settings.

What is the remediation?

Update Zimbra to version 10.1.21, which fixes the issue. If updating is not immediately possible, avoid the affected workflow by not using HTML reply composition with reply headers disabled in Classic UI.

CVE-2026-66912: Stored Cross-Site Scripting in Zimbra

Remediation

Event History

Frequently Asked Questions

Which users are exposed to this issue?

What does an attacker need to exploit it?

Are all reply workflows affected?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which users are exposed to this issue?

What does an attacker need to exploit it?

Are all reply workflows affected?

What is the remediation?