Zimbra has released an urgent security update to address a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client that could allow specially crafted emails to execute arbitrary code in a user's session. The flaw, patched in Zimbra Collaboration Suite 10.1.19, poses a serious risk to organizations relying on Zimbra for email and collaboration.

Vulnerability Details

The vulnerability is a stored (persistent) XSS flaw in the Zimbra Classic Web Client. Stored XSS occurs when an application stores untrusted input , in this case, email content , and later serves it to other users without proper sanitization or escaping. Attackers can craft a malicious email that, when opened by a victim in the Classic Web Client, executes arbitrary JavaScript in the context of the user's session.

According to Zimbra's advisory, "The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened. If exploited, it could allow access to mailbox information, session data, or account settings."

Key details:

Field	Value
Affected Component	Zimbra Classic Web Client
Vulnerability Type	Stored Cross-Site Scripting (XSS)
Severity	High (per Zimbra)
CVE ID	Not yet assigned
Patch Version	ZCS v10.1.19
Release Date	July 7, 2026
Attack Vector	Specially crafted email sent to victim

Unlike reflected XSS where the payload must be delivered through a link, stored XSS is particularly dangerous because the malicious script is embedded in the email itself and executes automatically when the email is rendered in the browser. No additional user interaction beyond opening the message is required.

Impact Assessment

For organizations running Zimbra, this vulnerability carries serious implications. An attacker who successfully exploits this flaw could:

Session Hijacking: The injected JavaScript can steal session cookies, allowing the attacker to impersonate the victim and access their Zimbra account without credentials. From there, an attacker can read all emails, send messages as the victim, and access calendar data and contacts.

Credential Theft: The XSS payload can present fake login dialogs or capture keystrokes, harvesting usernames and passwords for the Zimbra instance and potentially other internal applications.

Mailbox Data Exfiltration: Attackers can silently read, forward, or download all emails in the victim's mailbox, including sensitive communications, attachments, and internal documents.

Lateral Movement: A compromised Zimbra session can be used to send phishing emails to the victim's contacts , appearing to come from a trusted source , further propagating the attack within the organization.

Account Settings Manipulation: Attackers can modify forwarding rules, auto-responders, and filters to intercept future communications or maintain persistent access.

This is not Zimbra's first XSS rodeo. The platform has been targeted repeatedly by threat actors exploiting XSS flaws. In October 2025, CVE-2025-27915 (CVSS 5.4) was allegedly exploited as a zero-day against Brazilian military targets. Earlier flaws like CVE-2023-37580 and CVE-2024-27443 were also actively weaponized. Given this history, security teams should treat the current vulnerability with heightened urgency.

Affected Systems

Any organization running Zimbra Collaboration Suite with the Classic Web Client enabled is potentially affected. This includes:

• ZCS 10.1.x deployments (all versions before 10.1.19)
• ZCS 10.0.x deployments
• ZCS 9.0.x and 8.8.15 deployments (though these have separate upgrade paths)

The vulnerability specifically impacts users of the Classic Web Client interface. Organizations that exclusively use the modern Zimbra Web App (the newer UI) may have a reduced attack surface, but upgrading is still strongly recommended for defense-in-depth.

Mitigation & Patching

Step 1: Identify Your Zimbra Version

This will display your current ZCS version. If it is below 10.1.19, you are vulnerable.

Step 2: Download and Apply the Patch

Zimbra 10.1.19 is available through the official Zimbra repository. For most deployments, the patch can be applied via:

Step 3: Verify the Update

Special Upgrade Notes

• Upgrading from ZCS 10.1.x: No additional action required beyond the standard patch process.
• Upgrading from ZCS 10.0.x, 9.0.x, or 8.8.15: The SNMP mitigation must be updated and reapplied after upgrading. Follow the SNMP mitigation steps in the Security Advisory posted on the Zimbra wiki.

Alternative: Apply If Direct Patching Is Not Possible

If immediate patching is not feasible, consider these compensating controls:

1. Restrict Classic Web Client access at the network level
2. Enable web application firewall (WAF) rules that detect XSS patterns in email content
3. Monitor for unusual mailbox activity and forwarding rule changes
4. Encourage users to use the Modern Web App instead of Classic

Detection

There are no known public reports of active exploitation of this specific vulnerability as of publication. However, Zimbra XSS flaws have historically been targeted by state-sponsored groups. Security teams should watch for:

Indicators of Compromise:

• Unexpected email forwarding rules created in user mailboxes
• Login activity from unusual IP addresses or locations
• Emails in Sent folders that the user did not author
• Browser alerts or unexpected pop-ups when using the Classic Web Client
• Modified auto-responder settings or filters

Log Monitoring: Monitor Zimbra audit logs for:

• soap AccountNotFoundException errors (potential session hijacking attempts)
• Rapid creation or modification of filters and forwarding rules
• Access to mailboxes from unusual user-agent strings

Frequently Asked Questions

Does this vulnerability affect Zimbra Desktop? No, this vulnerability is specific to the Classic Web Client in Zimbra Collaboration Suite (server edition). Zimbra Desktop is not affected.

Is a CVE ID available? As of publication, no CVE ID has been assigned for this vulnerability. Zimbra's release notes list the security fix with an empty CVE-ID field.

Can the vulnerability be exploited without user interaction? The attack requires the victim to open a crafted email. However, this is a low bar , many email clients automatically preview or render messages, and users regularly open emails as part of their workflow.

Does the Modern Web App (new UI) have the same vulnerability? Zimbra's advisory specifically mentions the Classic Web Client. Organizations using the Modern Web App may have a reduced attack surface, but upgrading to 10.1.19 is still recommended.

Have there been past XSS vulnerabilities in Zimbra? Yes. Zimbra has patched several XSS flaws in recent years, including CVE-2025-27915 (alleged zero-day against Brazilian military), CVE-2024-27443, and CVE-2023-37580 , all of which were exploited by threat actors.

Key Takeaways

1. Patch immediately , Zimbra 10.1.19 fixes a critical stored XSS that lets crafted emails execute code in user sessions with no CVE ID yet assigned.

2. Check your version , Run zmcontrol -v to verify. If below 10.1.19, schedule an upgrade as a high-priority task.

3. Understand the risk , Stored XSS in an email client is particularly dangerous because the trusted nature of email communications makes users more likely to open messages.

4. Monitor for past patterns , Given Zimbra's history with XSS exploitation by state-sponsored actors, treat this with higher urgency than a typical "High" severity advisory.

5. Consider compensating controls , If immediate patching is impossible, restrict Classic Web Client access, enable WAF XSS rules, and audit mailbox forwarding rules.

---

Sources: The Hacker News - Critical Zimbra Flaw | Zimbra Blog: Patch Release 10.1.19 | Zimbra Wiki: 10.1.19 Release Notes