Key Takeaways
- Zimbra released ZCS v10.1.19 to fix a stored cross‑site scripting (XSS) flaw in the Classic Web Client.
- The vulnerability lets attackers run malicious code when a specially crafted email is opened, potentially stealing session data, account settings, or mailbox contents.
- Although no CVE ID has been assigned yet, the flaw was reported by Google’s Threat Analysis Group, which often detects zero‑day exploits used by state‑backed groups.
- Russian‑sponsored threat actors (e.g., Winter Vivern, APT29/Cozy Bear, APT28/Fancy Bear) have repeatedly exploited Zimbra XSS bugs to compromise government, military, and diplomatic targets.
- Organizations using the Classic Web Client should upgrade immediately to ZCS v10.1.19 and consider disabling the legacy interface if not required.
Overview of the Advisory
Zimbra’s security team issued an urgent notice urging customers to apply the latest patch for the Classic Web Client, the Ajax‑based interface that remains popular for its speed when handling large mail folders. The advisory notes that the flaw affects only users of this legacy client; the modern web client is unaffected. By releasing Zimbra Collaboration Suite (ZCS) version 10.1.19, the vendor aims to close a critical security gap that could be leveraged in targeted email‑based attacks.
Technical Details of the Stored XSS Vulnerability
The vulnerability is a stored cross‑site scripting (XSS) bug residing in the Classic Web Client’s handling of incoming email content. When a user opens a maliciously crafted message, the injected script executes within the victim’s browser context, operating with the same privileges as the legitimate Zimbra webmail session. Because the script is stored within the email body, it persists across sessions and can be triggered each time the offending message is viewed, increasing the window of opportunity for an attacker.
Potential Impact and Attack Vectors
Successful exploitation enables threat actors to hijack active sessions, exfiltrate authentication tokens, manipulate account settings, or harvest mailbox data such as contacts, calendars, and message archives. The stolen information can facilitate further credential theft, lateral movement within an organization’s network, or intelligence gathering against high‑value targets. Since the attack requires only that the victim open a tainted email, phishing or spear‑phishing campaigns are the most likely delivery mechanisms.
Vendor Recommendation and Patch Availability
Zimbra explicitly advises “any customer using the Classic Web Client should upgrade to ZCS v10.1.19 as soon as possible.” The patch is available through the standard Zimbra update channels, and administrators are encouraged to apply it promptly to mitigate risk. The company also notes that organizations that do not require the Classic UI may consider disabling it entirely as an additional hardening step.
Source of the Disclosure: Google’s Threat Analysis Group
The flaw was initially identified and reported by Google’s Threat Analysis Group (TAG), a team renowned for uncovering zero‑day exploits employed by nation‑state actors. TAG’s involvement underscores the seriousness of the vulnerability, as the group frequently detects vulnerabilities that are actively exploited in espionage campaigns targeting journalists, dissidents, and opposition figures.
Historical Exploitation by Russian State‑Sponsored Groups
Zimbra has been a recurring target for Russian‑backed hackers. In February 2023, the Winter Vivern group leveraged a reflected XSS vulnerability to breach Zimbra webmail portals, exfiltrating emails from NATO‑aligned officials, military personnel, and diplomats. Later, in October 2024, U.S. and U.K. cyber agencies warned that APT29 (also known as Midnight Blizzard or Cozy Bear), working for Russia’s SVR, was conducting mass‑scale attacks against vulnerable Zimbra servers using an exploit previously used to steal email credentials.
Recent Alerts from CISA and Shadowserver
In March 2025, the Cybersecurity and Infrastructure Security Agency (CISA) mandated that federal agencies patch another Zimbra XSS flaw tracked as CVE‑2025‑66376, which had been abused by APT28 (linked to Russia’s GRU) in operations against Ukrainian government entities. Shortly thereafter, Shadowserver reported that over 10,500 exposed Zimbra Collaboration Suite instances remained vulnerable to a different XSS flaw (CVE‑2025‑48700), highlighting the persistent challenge of securing legacy deployments against ongoing threats.
Broader Implications for Organizations
The pattern of repeated XSS vulnerabilities in Zimbra underscores the importance of maintaining up‑to‑date software, especially for web‑based collaboration platforms that expose internal communications to the internet. Organizations should adopt a defense‑in‑depth strategy: apply patches promptly, restrict access to the Classic Web Client to only those who truly need it, employ robust email filtering and anti‑phishing controls, and monitor for anomalous activity indicative of session hijacking or data exfiltration.
Conclusion and Call to Action
Zimbra’s latest release addresses a critical stored XSS vulnerability that could be weaponized by sophisticated threat actors, particularly those affiliated with Russian state‑sponsored groups. Given the historical exploitation of similar flaws and the active warnings from intelligence agencies, immediate patching to ZCS v10.1.19 is essential. Administrators should verify the upgrade’s success, consider disabling the Classic UI if unnecessary, and reinforce email security posture to mitigate the risk of future compromise.
