NewsBite analysis · Security
BleepingComputer
Zimbra urges customers to patch critical web client XSS flaw
Zimbra's security team has announced a critical vulnerability impacting the Classic Web Client of its Collaboration suite. The newly released version 10.1.19 aims to patch a stored cross-site scripting (XSS) flaw that could allow attackers to exploit specially crafted emails for malicious purposes. While not yet categorized with a CVE ID, the flaw poses serious risks for customer data, prompting urgent upgrades to safeguard user accounts and data.
Act nowConfidence: HighImmediate horizonCybersecurity risk: High
Published 10 Jul 2026, 12:50 UTC1 min read
Visit original article ↗Lead image — BleepingComputer
Summary
TL;DR
- Critical XSS vulnerability affects Zimbra Classic Web Client.
- Users urged to upgrade to ZCS v10.1.19 to patch the flaw.
- Exploitation could lead to theft of session data and mailbox information.
- Previously abused in attacks by state-backed hacking groups.
- Google's Threat Analysis Group identified the vulnerability.
Interesting facts
- Exploitation of vulnerabilities like this has been previously linked to APT groups.
- The vulnerability has not yet received a CVE ID for tracking.
- More than 10,500 instances of ZCS were reported vulnerable online.