Loading story…
Zimbra has urged customers to upgrade to Zimbra Collaboration 10.1.19 to remediate a critical stored cross-site scripting flaw in the Classic Web Client. The vulnerability, which does not yet have a CVE identifier, can be triggered through a specially crafted email and may execute malicious code when a user opens the message in the Classic UI. Successful exploitation could expose session data, account settings, and mailbox contents, creating a direct path to account compromise and data theft.
The issue was reported by Google Threat Analysis Group, and Zimbra said it has no evidence of active exploitation so far. The warning has drawn added attention because Zimbra products have been repeatedly targeted in recent years by Russian state-linked groups including Winter Vivern, APT29, and APT28, while other Zimbra flaws have also appeared in CISA KEV and been used in campaigns against government, military, and Ukrainian entities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Zimbra warned customers to apply the fix for the critical stored XSS flaw in the Classic Web Client. The company highlighted that opening a crafted email in the Classic UI could execute malicious code and expose mailbox contents and account data.
Zimbra released version 10.1.19 to remediate the critical stored XSS vulnerability affecting the Classic Web Client. The company said the issue had no CVE identifier yet and that there was no confirmed evidence of active exploitation.
Google's Threat Analysis Group reported a critical stored cross-site scripting vulnerability in Zimbra Collaboration Suite's Classic Web Client to Zimbra. The flaw can be triggered through specially crafted emails and could expose session data, account settings, and mailbox contents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceblog.zimbra.com
Open sourcewiki.zimbra.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zimbra released **Zimbra Collaboration Suite 10.1.20** to patch multiple critical and high-severity vulnerabilities affecting its email and collaboration platform, including versions of the **Classic Web Client** prior to `10.1.20`. The most serious issue is a critical unauthenticated command injection flaw in the SNMP monitoring component that could allow arbitrary operating system command execution when SNMP notifications are enabled and the integrated Swatchdog service is running. Zimbra and the Canadian Centre for Cyber Security urged administrators and users to review the advisory and apply the update promptly. The release also fixes four cross-site scripting vulnerabilities in the Classic Web Client, a mail forwarding restriction bypass tracked as **CVE-2026-50055**, an access control flaw in the EWS extension tracked as **CVE-2026-10631**, an authorization issue in mailbox delegation tracked as **CVE-2026-50054**, and a server-side request forgery bug in the Nextcloud integration. Zimbra said customers should update as soon as possible and did not report evidence that the vulnerabilities had been exploited in the wild.
Jul 21, 2026
More than 10,000 internet-exposed **Zimbra Collaboration Suite** servers remain vulnerable to `CVE-2025-48700`, an actively exploited cross-site scripting flaw that affects ZCS versions `8.8.15`, `9.0`, `10.0`, and `10.1`. The bug lets unauthenticated attackers execute arbitrary JavaScript in a victim’s session and steal sensitive data when a user opens a malicious email in the **Zimbra Classic UI**. Synacor released patches in June 2025, but Shadowserver still reported roughly **10,500** exposed unpatched systems, with the largest concentrations in Asia and Europe. **CISA** has added `CVE-2025-48700` to its **Known Exploited Vulnerabilities** catalog and ordered Federal Civilian Executive Branch agencies to secure affected servers within days because the flaw is being abused in the wild. The warning follows a broader pattern of Zimbra vulnerabilities being used in espionage-focused campaigns, with reporting linking earlier exploitation of similar flaws to Russian-aligned groups including **APT28**, **APT29**, and **Winter Vivern** against Ukrainian entities, NATO-aligned organizations, and other targets.
Jun 29, 2026
Zimbra released **version 10.1.16** with a strong recommendation that administrators upgrade immediately, citing high-severity issues and deployment risk. The update addresses multiple injection-class vulnerabilities affecting the collaboration suite, including **cross-site scripting (XSS)** in *Webmail* and *Briefcase* that could enable session hijacking and data theft via malicious script injection in a user’s browser. The release also patches an **XML External Entity (XXE)** flaw in the **EWS SOAP endpoint**, which could potentially be abused for local file disclosure, denial-of-service conditions, or **SSRF** depending on environment and parser behavior, and fixes an **authenticated LDAP injection** issue where insufficient sanitization could allow a logged-in user to manipulate LDAP queries to access or influence directory data. In addition to these targeted fixes, Zimbra reports broader hardening such as **stronger CSRF protections** through improved token validation, alongside other security-related stability adjustments.
Jun 29, 2026