{"id":288113,"date":"2026-07-10T17:08:00","date_gmt":"2026-07-10T21:08:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/07\/10\/update-now-critical-zimbra-classic-web-client-flaw-could-expose-mailboxes\/"},"modified":"2026-07-10T17:45:10","modified_gmt":"2026-07-10T21:45:10","slug":"update-now-critical-zimbra-classic-web-client-flaw-could-expose-mailboxes","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/07\/10\/update-now-critical-zimbra-classic-web-client-flaw-could-expose-mailboxes\/","title":{"rendered":"Update Now: Critical Zimbra Classic Web Client Flaw Could Expose Mailboxes"},"content":{"rendered":"

Update Now: Critical Zimbra Classic Web Client Flaw Could Expose Mailboxes<\/a><\/p>\n

https:\/\/securityaffairs.com\/195130\/hacking\/update-now-critical-zimbra-classic-web-client-flaw-could-expose-mailboxes.html<\/a><\/p>\n

Publish Date: 2026-07-10 17:08:00<\/a><\/p>\n

Source Domain: securityaffairs.com<\/a><\/p>\n

Update Now: Critical Zimbra Classic Web Client Flaw Could Expose Mailboxes<\/h2>\n<\/p>\n

\t\t\t\t\t\t\t Pierluigi Paganini<\/span>
\n\t\t\t\t\t\t\t\"\"\/ July 10, 2026<\/span><\/p>\n

\t\t\t\t\t\t\"\"\/<\/p>\n

Zimbra addressed a critical stored XSS vulnerability in its Classic Web Client that lets malicious emails execute code when opened.<\/h2>\n

Zimbra has released version 10.1.19 to fix a critical stored XSS vulnerability in its Classic Web Client, which is widely used to access Zimbra Collaboration. The flaw, which has not yet received a CVE ID, can be exploited by sending specially crafted emails that execute malicious code when opened in the Classic UI. \u00a0Successful exploitation could allow attackers to access to mailbox information, session data, or account settings.<\/p>\n

\u201cThe update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened. If exploited, it could allow access to mailbox information, session data, or account settings.\u201d reads the advisory<\/p>\n

\u201cWe strongly recommend all customers to upgrade to ZCS v10.1.19 to ensure they have received the latest security patches, bug fixes, and enhancements.\u201d<\/p>\n

Google\u2019s Threat Analysis Group discovered the vulnerability.<\/p>\n

Although there is no evidence of active exploitation yet, organizations using the Classic Web Client should update as soon as possible.<\/p>\n

Since the beginning of 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added [1, 2, 3] the following vulnerabilities to its\u00a0Known Exploited Vulnerabilities (KEV) catalog:<\/p>\n