Zimbra patches critical flaw letting a crafted email run code in your session

Zimbra is urging customers to update after fixing a critical stored cross-site scripting flaw in the Classic Web Client of its widely used email and collaboration platform. A specially crafted email can run malicious scripts when it is simply opened, potentially exposing mailbox contents, session data, and account settings, and enabling session hijacking or credential theft. The flaw, reported by Google's Threat Analysis Group, has no CVE assigned yet and is not confirmed as exploited, but the group often surfaces bugs used by state-backed actors. Zimbra's web client has been a repeated target: Russian-linked groups have exploited similar cross-site scripting flaws against government and military organizations. Updating to version 10.1.19 fixes it.

Check

Identify Zimbra Collaboration servers using the Classic Web Client, confirm their versions, and prioritize updating any that are internet-facing or serve high-value users such as executives and administrators.

Affected

Organizations running Zimbra Collaboration's Classic Web Client before version 10.1.19; an attacker can run code in a victim's session by sending an email the victim opens, risking mailbox and credential theft.

Fix

Update Zimbra Collaboration to version 10.1.19 promptly, given the platform's history of state-actor exploitation, and consider moving users to the modern web client and monitoring for suspicious email-borne scripts.