Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

A critical stored cross-site scripting (XSS) vulnerability in Zimbra's Classic Web Client could allow attackers to execute malicious scripts in user sessions via specially crafted emails. If exploited, the flaw could enable access to mailbox data, session information, and account settings. While Zimbra has not confirmed active exploitation, similar XSS flaws in Zimbra have been historically targeted. Users are advised to update to Zimbra Collaboration Suite version 10.1.19 for protection.

AI-extracted · verify before operational use