Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions
Zimbra Classic Web Client has a critical stored XSS flaw allowing code execution via crafted emails.
Zimbra is urging customers to update their Classic Web Client due to a critical stored cross-site scripting (XSS) vulnerability. This flaw allows specially crafted emails to execute malicious scripts within a user's session, potentially leading to access of mailbox information, session data, or account settings. While no exploitation in the wild has been confirmed, Zimbra has a history of XSS vulnerabilities being targeted.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Zimbra Collaboration Suite?
Get an email when a new story names Zimbra Collaboration Suite, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical stored XSS vulnerability in Zimbra's Classic Web Client allows attackers to embed malicious scripts inside crafted emails, which then execute within a victim's active browser session. This can expose sensitive mailbox data, session tokens, and account settings without requiring any additional authentication. The risk is amplified by Zimbra's documented history of XSS vulnerabilities being actively exploited in the wild, making unpatched instances high-value targets. Organizations that delay patching email platforms are particularly exposed because email is a universal attack surface with broad user adoption. Prompt application of vendor-issued patches is the most direct mitigation for this class of vulnerability.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2025-27915
- cve — CVE-2023-37580
- cve — CVE-2024-27443