# Zimbra Collaboration Suite Critical Stored XSS in Classic Web Client (Patched in ZCS 10.1.19)

> Zimbra patched an unassigned-CVE critical stored cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite, reported by Google's Threat Analysis Group, that could execute malicious JavaScript from a crafted email and steal session data, account settings, or mailbox information. This follows a pattern of at least two prior Zimbra Classic Web Client XSS vulnerabilities (CVE-2025-27915, CVE-2023-37580) that were actively exploited by state-backed actors including Winter Vivern (UNC4907) against government and military targets.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1176
- **ID:** TL-2026-1176
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-37580, CVE-2025-27915

## Description

On 2026-07-07/08, Zimbra released Zimbra Collaboration Suite (ZCS) 10.1.19, which fixes a critical stored cross-site scripting (XSS) vulnerability in the Classic Web Client. The flaw, reported by Google's Threat Analysis Group (TAG) — a team that routinely surfaces zero-days weaponized by state-backed hacking groups — allows an attacker to embed malicious script inside a specially crafted email that executes automatically in the victim's session when the message is opened in the Classic Web Client. Successful exploitation could allow theft of session tokens/cookies, account settings, or mailbox contents. As of the source reporting, no CVE identifier has been assigned and no confirmed in-the-wild exploitation has been reported; Zimbra's advisory language and Google TAG's involvement are the basis for the CRITICAL severity framing rather than a published CVSS score.

This disclosure is the third Classic Web Client stored/reflected XSS Zimbra has had to patch in roughly three years, and the pattern is directly relevant to defenders: CVE-2023-37580 (reflected XSS via a crafted 'st' URL parameter, patched July 2023) was exploited by at least four distinct threat clusters — including Winter Vivern (UNC4907) against Moldovan and Tunisian government bodies, and unknown actors against Greek, Vietnamese, and Pakistani government organizations — within weeks of a fix landing in Zimbra's public GitHub repository but before the patch was broadly deployed. In the Pakistan intrusion, Zimbra authentication tokens were exfiltrated to attacker infrastructure at ntcpk[.]org after a malicious script was loaded from applicationdevsoc[.]com. CVE-2025-27915 (stored XSS via insufficiently sanitized ICS/iCalendar content, patched by ZCS 9.0.0 Patch 44 / 10.0.13 / 10.1.5) was exploited in a campaign spoofing the Libyan Navy's Office of Protocol to deliver a malicious calendar invite against Brazil's military, using an ontoggle event inside an HTML <details> tag to run arbitrary JavaScript in the victim's authenticated Zimbra session and silently create mail-forwarding filters.

Given that history, TL-2026-1176 (patched in 10.1.19) should be treated as high-priority patching guidance even absent a CVE or confirmed exploitation: attackers have repeatedly reverse-engineered Zimbra XSS fixes from public commits/patch packages within days of release and weaponized them against government, military, and diplomatic targets before organizations upgraded. Zimbra's own guidance is that any customer running the Classic Web Client should upgrade to 10.1.19 immediately; the release also updated the zimbra-patch and zimbra-mbox-webclient-war packages.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1098.002 Additional Email Delegate Permissions
- T1114.003 Email Forwarding Rule
- T1539 Steal Web Session Cookie
- T1114 Email Collection
- T1119 Automated Collection
- T1020 Automated Exfiltration
- T1588.006 Vulnerabilities
- T1583.001 Domains
- T1566.002 Spearphishing Link
- T1684.001 Impersonation
- T1204.001 Malicious Link
- T1056.003 Web Portal Capture
- T1567 Exfiltration Over Web Service

## Sources

- [Zimbra urges customers to patch critical web client XSS flaw](https://www.bleepingcomputer.com/news/security/zimbra-urges-customers-to-patch-critical-web-client-xss-flaw/)
- [Zimbra Classic Web Client Vulnerability Allows Arbitrary JavaScript Execution](https://gbhackers.com/zimbra-classic-web-client-vulnerability/amp/)
- [Zimbra Releases/10.1.19](https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.19)
- [Zimbra Security Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)
- [Critical vulnerability makes Classic Web Client vulnerable](https://www.heise.de/en/news/Critical-vulnerability-makes-Classic-Web-Client-vulnerable-11356704.html)
- [Attackers exploit XSS flaw in Zimbra Collaboration Suite](https://www.scworld.com/news/attackers-exploit-xxs-flaw-in-zimbra-collaboration-suite)
- [Zimbra 0-day used to target international government organizations](https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/)
- [Zero-Day Flaw in Zimbra Email Software Exploited by Four Hacker Groups](https://thehackernews.com/2023/11/zero-day-flaw-in-zimbra-email-software.html)
- [CVE-2025-27915 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-27915)
- [CVE-2023-37580 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2023-37580)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1176