CVE-2026-93638

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite ZCS allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input...