CVE-2024-27443: Zimbra webmail classic calendar invite XSS via crafted header

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a high EPSS percentile, but exploitation requires the victim to view the message in the classic UI and the CVSS base is only 6.1.

What it is

Zimbra Collaboration 9.0 and 10.0 fail to properly validate the calendar header in the CalendarInvite feature of the classic webmail interface, allowing a stored/reflected XSS payload to be embedded in an email. When the victim opens the message in the classic UI, the script runs in their session context, which matters because webmail sessions hold mail and calendar data and are a known target for credential and token theft.

Impact

An attacker can execute arbitrary JavaScript in the victim's authenticated Zimbra session, enabling session or token theft, mailbox and calendar data access, and actions performed as the victim. The CVSS scope change (S:C) reflects that the impact can extend beyond the vulnerable component.

Attack surface

Reached remotely over the network by sending an email with a crafted calendar header; no authentication is required for the sender, but the victim must view the message in the Zimbra webmail classic interface (UI:R).

Exploitation

CVE-2024-27443 is listed in CISA KEV (added 2025-05-19, no known ransomware use) and has a high EPSS 30-day probability of 0.23632 (97.7th percentile), indicating observed exploitation and elevated likelihood. References include vendor release notes and ESET research coverage of Operation Roundpress.

What to do

• Apply the vendor security fixes in Zimbra 10.0.7 and 9.0.0 P39 (or later) immediately.
• Follow CISA KEV required action and BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.
• Restrict or migrate users off the classic webmail interface where feasible, since the flaw is specific to it.
• Enforce phishing-resistant MFA and short session lifetimes to limit the value of any stolen session.
• Filter or strip crafted calendar headers and active content at the mail gateway as a compensating control.

Detection

• Hunt mail logs and gateway records for inbound messages with unusual or malformed calendar header fields.
• Monitor Zimbra webmail and proxy logs for anomalous JavaScript-bearing requests or unexpected outbound calls from client sessions.
• Review authentication and session logs for token reuse, impossible-travel logins, or new session creation following calendar invite views.
• Search endpoint and browser telemetry for script execution originating from Zimbra webmail pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.