Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

Summary: Zimbra is urging customers to update the Classic Web Client to fix a critical stored cross-site scripting flaw that could let a specially crafted email run malicious code when opened, potentially exposing mailbox information, session data, or account settings. The vulnerability has no CVE identifier yet, and Zimbra said it has no evidence of exploitation in the wild, though the article notes prior Zimbra XSS flaws including CVE-2025-27915, CVE-2023-37580, and CVE-2024-27443 have drawn attacker interest since December 2021.
What's compelling: The fix is a client update to Zimbra Collaboration Suite 10.1.19, and the exposure runs through email itself - a crafted message that executes in a user's session can reach mailbox information, session data, and account settings without any user action beyond opening it.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-37580 CVE-2024-27443 CVE-2025-27915
Related: From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine Cyber Risks ·
CVE-2025-27915: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Known Exploited Vulnerabilities · Oct 07, 2025
CVE-2024-27443: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Known Exploited Vulnerabilities · May 19, 2025