Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-37580 | Stored Cross-Site Scripting (XSS) in Synacor Zimbra Collaboration Suite (ZCS) | 6.1 | 49% | KEV | KEV |
| CVE-2024-27443 | Cross-Site Scripting in Zimbra Collaboration Suite CalendarInvite (Classic Webmail) | 6.1 | 25% | KEV | KEV |
| CVE-2025-27915 | Stored XSS in Zimbra Collaboration Suite Classic Web Client via Malicious ICS Files | 5.4 | 4% | KEVPoC | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Jul 11, 2026 Vulnerability / Email Security Zimbra is urging customers to apply updates to address a critical security vulnerability impacting the Classic Web Client that could result in arbitrary code execution. The vulnerability has been described as a case of stored cross-site scripting (XSS) that could allow specially crafted emails to execute malicious scripts in a user's session.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.