One Email, Full Session Takeover: Inside Zimbra's Critical Classic Web Client Code Execution Flaw

Key Details

Overview

Zimbra Collaboration Suite is one of the most widely deployed open-source email and collaboration platforms in the world, used extensively by enterprises, service providers, government agencies, and managed hosting providers as a lower-cost alternative to Microsoft Exchange. Its broad footprint — combined with a long history of being targeted by advanced persistent threat (APT) groups for espionage-driven mailbox access — makes any pre-authentication or zero-click flaw in ZCS especially consequential.

On July 7, 2026, Zimbra quietly released ZCS 10.1.19 to address what it described only as "a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened." According to Zimbra's advisory, successful exploitation "could allow access to mailbox information, session data, or account settings." The company has not released a detailed root-cause writeup or proof-of-concept, and notably has not yet requested or published a CVE identifier for the flaw — an unusual gap for a vulnerability of this severity.

Technical Analysis

The vulnerability is a stored cross-site scripting (XSS) flaw rooted in how the Classic Web Client parses and renders HTML email content. Stored XSS differs from reflected XSS in a critical way: the malicious payload does not depend on tricking a user into clicking a link. Instead, the payload is persisted server-side — in this case, inside the body of an email sitting in the victim's mailbox — and is re-executed by the browser every time the message is rendered.

Based on the vendor's description and the pattern typical of prior Zimbra Classic UI XSS issues, the likely exploitation chain works as follows:

Potential Impact

Zimbra's own advisory and independent analysis converge on the following post-exploitation outcomes:

• Session hijacking: theft of active session tokens, allowing the attacker to impersonate the victim without needing their password.
• Mailbox data exfiltration: read access to emails, contacts, calendar entries, and shared files/briefcase content within the compromised session.
• Account configuration tampering: silent modification of mail filters, forwarding rules, or delegate access — a common persistence technique in business email compromise (BEC) operations.
• Lateral movement / follow-on campaigns: a compromised mailbox can be weaponized to send further crafted emails to internal contacts, propagating the payload or pivoting into broader social-engineering campaigns.
• Credential and token theft: depending on payload design, exfiltration of authentication artifacts reusable against other internal systems tied to the victim's identity.

Affected Products and Versions

Patch and Remediation Guidance

Zimbra is urging all customers running the Classic Web Client to upgrade to ZCS 10.1.19 immediately, regardless of which branch they currently run. There is no configuration-only workaround published by the vendor.

• ● Upgrade to ZCS 10.1.19 ("Daffodil") on all mailbox/proxy nodes — this is the only complete fix.
• ● Reapply SNMP mitigation measures post-upgrade if migrating from ZCS 10.0.x, 9.0.x, or 8.8.15. Zimbra's advisory explicitly notes existing SNMP mitigations do not automatically carry over for customers coming from these older branches. Organizations already on 10.1.x are not required to take this extra step.
• ● Follow Zimbra's official upgrade path and validate build hashes for zimbra-patch and zimbra-mbox-webclient-war post-installation.
• ● Audit mailboxes for suspicious stored content — review recently delivered emails containing unusual embedded HTML/script-like markup, particularly for high-value targets (executives, IT admins, finance staff).
• ● Review session and account activity logs for anomalous filter/forwarding-rule changes, unexpected delegate access grants, or logins from unfamiliar IP ranges preceding the July 7 patch.
• ● Apply interim compensating controls — restrict/monitor Classic Web Client usage in favor of the Modern UI where feasible, and tighten email gateway filtering for inbound HTML with obfuscated or encoded script payloads.
• ● Track the CVE assignment and update internal vulnerability management systems once an official identifier replaces the SVE-110166 placeholder used here.

Why This Matters

This disclosure continues a recurring pattern for Zimbra: stored XSS and code-execution flaws in the Classic Web Client have been a persistent weak point, with prior incidents including CVE-2024-45512, CVE-2024-45510, and CVE-2024-45519 (the latter a command-execution bug in the postjournal service later added to CISA's Known Exploited Vulnerabilities catalog after in-the-wild abuse). The involvement of Google's Threat Analysis Group in reporting this new flaw — rather than a routine internal audit or bug bounty submission — is a strong signal that the vulnerability class is of interest to sophisticated threat actors.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.