Zimbra - Zimbra Collaboration Suite (zcs) - CRITICAL - CVE-2026-93647. An unauthenticated attacker can exploit a vulnerability in the Zimbra Collaboration Suite by injecting active markup into the RFC From address of a COUNTER message. When the message is accessed in Zimbra Classic, it triggers stored XSS, potentially granting the attacker unauthorized access to the victim's mailbox data and the ability to impersonate the victim.