Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

Zimbra is urging customers to patch a critical vulnerability in its Classic Web Client, described as a stored cross-site scripting flaw. A specially crafted email can execute malicious scripts within a user’s active session, potentially enabling arbitrary code execution in that context. The issue has not yet been assigned a CVE identifier. Administrators running Zimbra Collaboration should apply the vendor’s update once available.