CVE-2024-50599: Zimbra Collaboration Suite webmail calendar reflected XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is remotely reachable without authentication and has a very high EPSS score, though it requires user interaction and only yields script execution in the victim's browser.

What it is

Zimbra Collaboration Suite 8.8.15 has a reflected cross-site scripting flaw in a webmail calendar endpoint caused by improper handling of user-supplied input, which is echoed back into the HTML response. Because the endpoint is reachable by unauthenticated requests and the payload executes in the victim's browser, it can be used to run script in a logged-in user's session.

Impact

An attacker can execute arbitrary script in the context of a victim's Zimbra webmail session, enabling session or credential theft and actions performed as the victim. The CVSS scope change (S:C) reflects that the injected script can affect resources beyond the vulnerable component.

Attack surface

Reached over the network through a crafted URL to a webmail calendar endpoint; no authentication is required to deliver the request, but the victim must interact with the link for the script to execute (UI:R).

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tag appears in the references, but EPSS is high at 0.6065 (99.1st percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Apply the Zimbra 8.8.15 P46 security fixes referenced in the vendor release notes, or upgrade to a supported release line.
• If immediate patching is not possible, restrict or monitor access to the webmail calendar endpoints and consider a WAF rule blocking reflected script payloads.
• Enforce output encoding and input validation on calendar endpoint parameters as a defense-in-depth measure.
• Harden webmail sessions with short timeouts, HttpOnly and Secure cookie flags, and phishing-resistant MFA to limit the value of a stolen session.

Detection

• Search web and proxy logs for requests to Zimbra calendar endpoints containing script tags, event handlers, or encoded HTML in query parameters.
• Monitor for anomalous or unexpected script content in webmail calendar responses.
• Alert on repeated requests from a single source to calendar endpoints with unusual parameter patterns, which may indicate scanning or exploitation attempts.
• Review authentication and session logs for suspicious activity following access to crafted calendar URLs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.