CVE-2026-33368 Cross-site scripting in n/a

Medium 6.1 Published 20 Mar 2026 Updated 23 Mar 2026

Unauthenticated attackers can inject malicious JavaScript via crafted URLs in Zimbra Webmail, potentially stealing user data or hijacking sessions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-33368?

CVE-2026-33368 is a medium-severity cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious JavaScript into a crafted URL. When a victim user accesses the link, the injected script executes in the context of the Zimbra webmail application, which could allow the attacker to perform actions on behalf of the victim.

Weakness: CWE-79

Which versions are affected by CVE-2026-33368?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2026-33368?

No fix has been published for CVE-2026-33368 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-33368 being exploited?

There is no known exploitation of CVE-2026-33368 in the wild and no public exploit code.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-fc64-9942-699m.