Medium severity6.1NVD Advisory· Published Mar 20, 2026· Updated Apr 1, 2026
CVE-2026-33368
CVE-2026-33368
Description
Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious JavaScript into a crafted URL. When a victim user accesses the link, the injected script executes in the context of the Zimbra webmail application, which could allow the attacker to perform actions on behalf of the victim.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*Range: >=10.0.0,<10.1.16
- Range: >=10.0, <=10.1
Patches
Vulnerability mechanics
References
4- wiki.zimbra.com/wiki/Security_CenternvdVendor AdvisoryRelease Notes
- wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesnvdVendor Advisory
- wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16nvdRelease Notes
- wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicynvdProduct
News mentions
0No linked articles in our index yet.