Critical Stored XSS in Zimbra Classic Web Client Exposes Mailboxes

Zimbra has urged customers to upgrade to Zimbra Collaboration 10.1.19 to remediate a critical stored cross-site scripting flaw in the Classic Web Client. The vulnerability, which does not yet have a CVE identifier, can be triggered through a specially crafted email and may execute malicious code when a user opens the message in the Classic UI. Successful exploitation could expose session data, account settings, and mailbox contents, creating a direct path to account compromise and data theft.

The issue was reported by Google Threat Analysis Group, and Zimbra said it has no evidence of active exploitation so far. The warning has drawn added attention because Zimbra products have been repeatedly targeted in recent years by Russian state-linked groups including Winter Vivern, APT29, and APT28, while other Zimbra flaws have also appeared in CISA KEV and been used in campaigns against government, military, and Ukrainian entities.