Zimbra patches critical stored XSS flaw in Classic Web Client
Summary
Zimbra released ZCS v10.1.19 to fix a critical stored XSS flaw in its Classic Web Client. Crafted emails could trigger code when opened and potentially expose session data, account settings, or mailbox information. The flaw has no CVE yet and is not tagged as exploited.
Key points
- The stored XSS flaw affects Zimbra’s Classic Web Client.
- A specially crafted email can trigger the flaw when a user opens it.
- Successful exploitation could expose session data, account settings, or mailbox information.
- Zimbra released ZCS v10.1.19 and urged Classic Web Client users to upgrade promptly.
- Google’s Threat Analysis Group reported the issue; Zimbra has not tagged it as exploited in the wild.
- The vulnerability has not yet been assigned a CVE identifier.
Article Details
- Vulnerability Types
- Stored cross-site scripting (XSS)
- Severity
- Critical
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2025-48700vulnerable to ongoing attacks exploiting another cross-site scripting (XSS) security flaw (tracked as CVE-2025-48700).CVE-2025-66376and Infrastructure Security Agency (CISA) ordered federal agencies to patch another Zimbra XSS flaw (CVE-2025-66376) exploited by hackers linked to the APT28 group (linked to Russia’s military intelligence service) in
Threat Actors
APT28The article links APT28 to hackers who exploited CVE-2025-66376 in attacks targeting Ukrainian government entities.Cozy BearThe article identifies Cozy Bear as another name for APT29, which reportedly targeted vulnerable Zimbra servers at mass scale in October 2024.ICE RELICReportedly targeted vulnerable Zimbra servers at mass scale in October 2024. The article identifies Midnight Blizzard and Cozy Bear as other names for APT29.Midnight BlizzardThe article identifies Midnight Blizzard as another name for APT29, which reportedly targeted vulnerable Zimbra servers at mass scale in October 2024.Winter VivernUsed a reflected XSS exploit to breach Zimbra webmail portals in February 2023 and steal emails.
Vendors
Products
Classic Web ClientZimbra has released ZCS v10.1.19 to fix a critical stored XSS flaw in the Classic Web Client that could let attackers steal session data, account settings, or mailbox information through malicious emails.Zimbra Collaboration SuiteThe Zimbra security team urged customers to patch a critical vulnerability affecting the Classic Web Client used to access the Zimbra Collaboration suite.