Skip to content
Multiple XSS Vulnerabilities Disclosed in Request Tracker and Zimbra Collaboration Software

Multiple XSS Vulnerabilities Disclosed in Request Tracker and Zimbra Collaboration Software

First seen 30 Oct 2026, 16:53 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 18:16 UTC

Recent research by CERT Polska revealed several vulnerabilities in Request Tracker (RT) and Zimbra Collaboration software. The vulnerabilities include CVE-2026-105454, CVE-2026-105455, and CVE-2026-105456 in RT, which involve Stored Cross-Site Scripting (XSS) that can be exploited by unauthenticated attackers through malicious email links and improperly sanitized content. In Zimbra, CVE-2026-66911 and CVE-2026-66912 also involve Stored XSS vulnerabilities that allow attackers to execute JavaScript in the context of a victim's browser via manipulated email headers. All identified vulnerabilities have been patched in their respective software versions. The vulnerabilities were disclosed on October 29 and 30, 2026, with patches available for immediate application.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-29
CVE-2026-66911 and CVE-2026-66912 published
Zimbra Collaboration vulnerabilities disclosed, allowing Stored XSS via email headers. Patched in version 10.1.21.
Cert.Pl
2026-10-30
CVE-2026-105454, CVE-2026-105455, and CVE-2026-105456 published
Request Tracker vulnerabilities disclosed, enabling Stored XSS through email links and unsanitized content. Patched in versions 5.0.11 and 6.0.4.
Cert.Pl

More articles in this cluster (5)

Following this threat?

Track CVE-2026-105454 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which versions of Request Tracker are affected?
Versions prior to 5.0.11 and 6.0.4 are affected by the identified vulnerabilities.
What should I do to protect my systems?
Apply the latest patches for Request Tracker and Zimbra Collaboration software as soon as possible.
Are these vulnerabilities actively being exploited?
No confirmed exploitation has been reported for these vulnerabilities at this time.