Zimbra 10.1.19 Patches Critical Classic Web Client XSS

Zimbra has released Zimbra Collaboration 10.1.19 to fix a critical security issue in the Classic Web Client that can be triggered when a user opens a specially crafted email. The vendor says the flaw can let malicious code run in the user’s webmail session and may expose mailbox information, session data, or account settings.^[1]

The issue is currently listed without a CVE identifier or CVSS score, but Zimbra’s security advisory describes it as a stored cross-site scripting vulnerability affecting the Classic Web Client and credits Google Threat Analysis Group as the reporter.^[2] That combination matters: Zimbra is often used as an internet-facing enterprise mail platform, and webmail bugs that execute inside an authenticated mailbox session can turn a normal-looking message into an account-compromise path.

What Zimbra admins should check now

Zimbra’s own guidance is narrow and practical: customers using the Classic Web Client should upgrade to ZCS v10.1.19 as soon as possible.^[1] The advisory page also notes that supported versions are the ones listed, while older unsupported releases often share the same classes of vulnerabilities and should be moved to supported builds.^[2]

This is not described as a server-side shell vulnerability. The risk is still serious because the malicious script runs in the victim’s webmail context after the crafted email is opened. In practical terms, administrators should treat successful exploitation as potential access to the victim’s mailbox view, session state, preferences, and account settings rather than as a generic “website XSS” problem.

First, confirm whether users in the organization still rely on the Classic Web Client. If Classic is available, prioritize the 10.1.19 update on exposed Zimbra servers and do not wait for a CVE number before scheduling the change. Zimbra’s July 7 release post labels the patch security severity as High and the deployment risk as Low, which is a strong signal that the patch should move quickly through routine maintenance windows.^[1]

Second, look for mailbox-level changes that would be useful after a session compromise: suspicious forwarding rules, new filters, altered recovery details, unexpected delegated access, and account-setting changes around the time a suspicious email was opened. If logs show a targeted user interacting with a suspected message, invalidate active sessions and consider credential rotation for that account.

Third, brief help-desk and mail administrators not to dismiss this as ordinary phishing. A crafted message that executes script in webmail can blur the line between “user clicked something” and “mail client rendered something dangerous.” For context, Zimbra has repeatedly been targeted through mail-facing bugs, including earlier zero-day and RCE incidents covered by HowToFix.guide’s reports on an unpatched Zimbra vulnerability under attack, 900 compromised Zimbra servers, and later patches for a critical Zimbra RCE.

The public record does not currently say that this new Classic Web Client flaw is being exploited in the wild. That should not lower the urgency too much: Zimbra mail servers are attractive targets, the flaw is email-delivered, and the affected surface is the webmail session itself. The safest reading is simple: patch to 10.1.19, reduce Classic Web Client exposure where possible, and review high-value mailboxes for signs of session or settings abuse.