Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

Zimbra has released an update to address a critical stored XSS vulnerability in the Classic Web Client that could let specially crafted emails run malicious scripts, potentially exposing mailbox information, session data, or account settings; customers are advised to update to Zimbra Collaboration Suite 10.1.19. No CVE or confirmed in-the-wild exploitation has been reported, though Zimbra XSS issues have been targeted historically.