Threat reportVulnerabilityTL-2026-1176
Zimbra Collaboration Suite Critical Stored XSS in Classic Web Client (Patched in ZCS 10.1.19)
Zimbra Collaboration Suite Critical Stored XSS in Classic (TL-2026-1176) is a critical-severity software vulnerability, first published 2026-07-10. It has no confirmed attribution, affects Zimbra Zimbra Collaboration Suite (Classic Web Client), references 2 CVEs (CVE-2023-37580, CVE-2025-27915), maps to 16 MITRE ATT&CK techniques (T1020, T1056.003, T1098.002), and is covered by 9 detection rules and 23 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-1176
- Threat ID
- TL-2026-1176
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- government administration, military, diplomatic, collaboration-software
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Zimbra Collaboration Suite Critical Stored XSS in Classic
Malware and tooling: EmailThief, nuclei-templates CVE-2023-37580.yaml
How Zimbra Collaboration Suite Critical Stored XSS in Classic works
Zimbra patched an unassigned-CVE critical stored cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite, reported by Google's Threat Analysis Group, that could execute malicious JavaScript from a crafted email and steal session data, account settings, or mailbox information. This follows a pattern of at least two prior Zimbra Classic Web Client XSS vulnerabilities (CVE-2025-27915, CVE-2023-37580) that were actively exploited by state-backed actors including Winter Vivern (UNC4907) against government and military targets.
On 2026-07-07/08, Zimbra released Zimbra Collaboration Suite (ZCS) 10.1.19, which fixes a critical stored cross-site scripting (XSS) vulnerability in the Classic Web Client. The flaw, reported by Google's Threat Analysis Group (TAG) — a team that routinely surfaces zero-days weaponized by state-backed hacking groups — allows an attacker to embed malicious script inside a specially crafted email that executes automatically in the victim's session when the message is opened in the Classic Web Client. Successful exploitation could allow theft of session tokens/cookies, account settings, or mailbox contents. As of the source reporting, no CVE identifier has been assigned and no confirmed in-the-wild exploitation has been reported; Zimbra's advisory language and Google TAG's involvement are the basis for the CRITICAL severity framing rather than a published CVSS score.
This disclosure is the third Classic Web Client stored/reflected XSS Zimbra has had to patch in roughly three years, and the pattern is directly relevant to defenders: CVE-2023-37580 (reflected XSS via a crafted 'st' URL parameter, patched July 2023) was exploited by at least four distinct threat clusters — including Winter Vivern (UNC4907) against Moldovan and Tunisian government bodies, and unknown actors against Greek, Vietnamese, and Pakistani government organizations — within weeks of a fix landing in Zimbra's public GitHub repository but before the patch was broadly deployed. In the Pakistan intrusion, Zimbra authentication tokens were exfiltrated to attacker infrastructure at ntcpk[.]org after a malicious script was loaded from applicationdevsoc[.]com. CVE-2025-27915 (stored XSS via insufficiently sanitized ICS/iCalendar content, patched by ZCS 9.0.0 Patch 44 / 10.0.13 / 10.1.5) was exploited in a campaign spoofing the Libyan Navy's Office of Protocol to deliver a malicious calendar invite against Brazil's military, using an ontoggle event inside an HTML <details> tag to run arbitrary JavaScript in the victim's authenticated Zimbra session and silently create mail-forwarding filters.
Given that history, TL-2026-1176 (patched in 10.1.19) should be treated as high-priority patching guidance even absent a CVE or confirmed exploitation: attackers have repeatedly reverse-engineered Zimbra XSS fixes from public commits/patch packages within days of release and weaponized them against government, military, and diplomatic targets before organizations upgraded. Zimbra's own guidance is that any customer running the Classic Web Client should upgrade to 10.1.19 immediately; the release also updated the zimbra-patch and zimbra-mbox-webclient-war packages.
MITRE ATT&CK techniques used in TL-2026-1176
Exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service
Credential Access
T1056.003 Web Portal Capture; T1539 Steal Web Session Cookie
Persistence
T1098.002 Additional Email Delegate Permissions
Collection
T1114 Email Collection; T1119 Automated Collection
collection
T1114.003 Email Forwarding Rule
Initial Access
T1189 Drive-by Compromise; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Execution
T1204.001 Malicious Link; T1204.002 Malicious File
Resource Development
T1583.001 Domains; T1588.006 Vulnerabilities
stealth
Affected products and versions in Zimbra Collaboration Suite Critical Stored XSS in Classic
- Zimbra — Zimbra Collaboration Suite (Classic Web Client)
Vulnerable versions: all versions prior to 10.1.19 using the Classic Web Client
Fixed in: 10.1.19
Remediation for Zimbra Collaboration Suite Critical Stored XSS in Classic
Patches
- Zimbra Collaboration Suite 10.1.19 (zimbra-patch 10.1.19.1783177840-2, zimbra-mbox-webclient-war 10.1.19.1783175257-1) — fixes the unassigned-CVE Classic Web Client stored XSS
- Zimbra Collaboration Suite 9.0.0 Patch 44 / 10.0.13 / 10.1.5 — fixes CVE-2025-27915 (ICS-based stored XSS)
- Zimbra Collaboration 8.8.15 Patch 41+ — fixes CVE-2023-37580 (reflected XSS via 'st' URL parameter)
Immediate actions
- Upgrade all Zimbra Collaboration Suite instances using the Classic Web Client to ZCS 10.1.19 or later immediately
- If immediate upgrade is not possible, disable or restrict access to the Classic Web Client until patched
- Reapply the SNMP mitigation from the Zimbra Security Advisory after upgrading from 10.0.x, 9.0.x, or 8.8.15 to 10.1.19
- Review mailbox filter/forwarding rules and delegated access grants for unauthorized changes, based on prior Zimbra XSS post-exploitation behavior
Workarounds
- Disable the Classic Web Client and force users onto the Modern Web Client where the vulnerability does not apply, if upgrading cannot happen immediately
Longer-term hardening
- Quarantine or sanitize inbound .ics/iCalendar attachments and HTML email content at the mail gateway
- Monitor Zimbra authentication/session tokens for anomalous reuse and enforce session-binding controls
- Track Zimbra's public security advisory feed and GitHub commit history for pre-disclosure patch diffs, since prior Zimbra XSS bugs were weaponized within days of a fix landing in the public repo but before broad patch adoption
- Subscribe to Google TAG and Zimbra advisory notifications given the recurring targeting of Zimbra by state-backed actors
CVEs associated with Zimbra Collaboration Suite Critical Stored XSS in Classic
Weaknesses (CWE) in Zimbra Collaboration Suite Critical Stored XSS in Classic
Timeline of Zimbra Collaboration Suite Critical Stored XSS in Classic
- Google TAG observes first exploitation of what becomes CVE-2023-37580, targeting an organization in Greece
- Fix for CVE-2023-37580 pushed to Zimbra's public GitHub repository ahead of the official release, enabling attackers to reverse-engineer the bug
- Winter Vivern (UNC4907) exploits CVE-2023-37580 against government organizations in Moldova and Tunisia
- Zimbra officially patches CVE-2023-37580 (ZCS 8.8.15 Patch 41)
- A Pakistani government organization is compromised via CVE-2023-37580; Zimbra authentication tokens exfiltrated to ntcpk[.]org after a malicious script is loaded from applicationdevsoc[.]com
- StrikeReady researchers publish analysis of CVE-2025-27915 exploitation via malicious ICS calendar invites
- Reporting details a campaign spoofing the Libyan Navy's Office of Protocol to deliver a CVE-2025-27915 exploit against Brazil's military via a malicious calendar invite
- Zimbra releases ZCS 10.1.19, fixing an unassigned-CVE stored XSS in the Classic Web Client reported by Google TAG
- BleepingComputer reports on the ZCS 10.1.19 Classic Web Client XSS fix and Zimbra's urgent upgrade recommendation
Sources cited for Zimbra Collaboration Suite Critical Stored XSS in Classic
- Zimbra urges customers to patch critical web client XSS flaw
- Zimbra Classic Web Client Vulnerability Allows Arbitrary JavaScript Execution
- Zimbra Releases/10.1.19
- Zimbra Security Advisories
- Critical vulnerability makes Classic Web Client vulnerable
- Attackers exploit XSS flaw in Zimbra Collaboration Suite
- Zimbra 0-day used to target international government organizations
- Zero-Day Flaw in Zimbra Email Software Exploited by Four Hacker Groups
- CVE-2025-27915 Detail - NVD
- CVE-2023-37580 Detail - NVD
Detection coverage for TL-2026-1176
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1176 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.