CVE-2023-34192: Zimbra ZCS autoSaveDraft XSS enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.0, CISA KEV listing and very high EPSS probability indicate a critical, actively exploited flaw requiring urgent patching.

What it is

Zimbra Collaboration Suite 8.8.15 has a cross-site scripting flaw in the /h/autoSaveDraft function. A remote authenticated attacker can inject a crafted script that leads to arbitrary code execution. The record does not specify the exact patch version or the full list of affected builds beyond 8.8.15.

Impact

An attacker with a valid account can run arbitrary code in the context of the affected service, potentially compromising the mail server and user sessions. The CVSS scope change and high confidentiality, integrity and availability scores indicate broad impact beyond the initial user.

Attack surface

Reached over the network through the /h/autoSaveDraft endpoint. The attacker must be authenticated (PR:L) and some user interaction is required (UI:R), consistent with a stored or reflected XSS that executes when a victim views the crafted content.

Exploitation

CVE-2023-34192 is listed in CISA KEV with a due date of 2025-03-18, and EPSS shows a 30-day probability of 0.77266 (99.53 percentile), indicating active exploitation is expected. No ransomware campaign use is documented in the record.

What to do

• Apply the vendor security update for Zimbra ZCS per the Zimbra Security Center advisories.
• If patching is not immediately possible, follow CISA BOD 22-01 guidance and vendor mitigations, or discontinue use of the affected product.
• Restrict access to the /h/autoSaveDraft endpoint and enforce least privilege on mail accounts.
• Monitor Zimbra security advisories for updated fixed versions and re-check exposure after patching.

Detection

• Inspect web and proxy logs for crafted requests to /h/autoSaveDraft containing script payloads.
• Monitor for unexpected process execution or outbound connections originating from the Zimbra server.
• Review mail and draft content for injected script tags or unusual HTML in auto-saved drafts.
• Alert on authentication events followed by anomalous requests to the autoSaveDraft endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.