Zimbra Patches Critical Email XSS Found by Google TAG

You don't have to click anything. You don't have to download an attachment. You just have to open the email—and Zimbra's Classic Web Client will run whatever code the sender put inside it.

That's the vulnerability Zimbra quietly fixed this month in ZCS 10.1.19, after Google's Threat Analysis Group flagged a stored cross site scripting flaw serious enough to warrant an out of cycle patch. No CVE number has been assigned yet. That doesn't make it less urgent—TAG doesn't usually spend its time on bugs nobody wants.

Key Takeaways

• Zimbra shipped ZCS 10.1.19 on July 9, 2026, fixing a stored XSS flaw in the Classic Web Client discovered by Google's Threat Analysis Group, according to Bleeping Computer.
• A specially crafted email runs malicious script the instant it's opened in Classic Web Client—no click, attachment, or additional interaction required.
• Successful exploitation can expose session data, account settings, and full mailbox contents, effectively handing an attacker the victim's live session.
• No CVE ID has been assigned and Zimbra has not confirmed in the wild exploitation as of publication; only Classic Web Client deployments are affected.
• This is the third Zimbra webmail incident where opening an email was the entire attack chain that gblock.app has covered in 2026, following incidents in March and April.

What Is the Zimbra Classic Web Client XSS Flaw?

The flaw is a stored cross site scripting vulnerability in Zimbra Collaboration Suite's Classic Web Client that lets an attacker's script execute inside a victim's authenticated session as soon as they open a malicious message. Zimbra's own advisory put it bluntly: "a specially crafted email could run malicious code when the email is opened," with the potential to expose "mailbox information, session data, or account settings," according to Bleeping Computer.

"Stored" is the operative word. Unlike a reflected XSS bug, which needs a victim to click a booby trapped link, a stored payload sits inside the message itself once it lands in the mailbox. Anyone who opens it in Classic Web Client triggers the script—including, in theory, anyone the message gets forwarded to. The fix landed in ZCS 10.1.19, codenamed "Daffodil," distributed through the zimbra-patch and zimbra-mbox-webclient-war packages, and only affects organizations still running Classic Web Client rather than the Modern UI, per The Hacker News.

How Does the Attack Work?

An attacker needs nothing more than the ability to deliver a single email to the target's Zimbra mailbox. Because Classic Web Client failed to properly sanitize or escape certain content when rendering messages, embedding a script inside the email body was enough to get it to execute in the reader's browser context—with the same permissions as the logged in user. That means the script can read cookies, session tokens, and mailbox data, and potentially issue requests on the victim's behalf without them noticing anything unusual on screen.

The fact that Google's Threat Analysis Group found this one matters for how seriously to take it. TAG's beat is state linked hacking campaigns against journalists, dissidents, opposition politicians, and government targets—it doesn't typically go bug hunting in commodity software for fun. Zimbra says it hasn't tagged this flaw as exploited in the wild yet, but TAG's track record with this exact platform argues for treating "not yet confirmed" as a very short runway.

Who Is Affected?

Anyone self hosting Zimbra Collaboration Suite's Classic Web Client on a version earlier than 10.1.19. Zimbra markets itself as serving over 6,000 organizations across 127 countries, many of them government agencies, universities, and mid size enterprises that chose Zimbra specifically to avoid Microsoft or Google's cloud lock in—which also means many of them self host and patch on their own schedule rather than getting automatic updates.

This is not the platform's first brush with this exact failure mode. In 2023, a separate reflected XSS bug (CVE-2023-37580) was exploited by four distinct hacking groups—including the Russia aligned Winter Vivern—against government targets in Moldova and Tunisia before an official patch even existed, according to The Hacker News' contemporaneous coverage. We covered a related Zimbra XSS incident that put 10,000 servers on CISA's three day patch clock back in April, and a month before that, Russian military hackers hid an attack inside a CSS rule in Zimbra mail—again triggered by nothing more than opening the message. Three separate "opening the email was enough" disclosures in four months is not a coincidence; it's a pattern in how webmail rendering engines get built and audited.

Why Email Users Should Care

Most people reading about a Zimbra vulnerability don't run Zimbra. But the mechanism here—a message doing something the moment you open it, before you've clicked a single link—is exactly the class of threat that should recalibrate how safe "just opening an email" feels. Webmail clients render HTML, CSS, and increasingly rich content by design, and every one of those rendering paths is a potential place where sanitization can fail.

Gmail isn't Zimbra, and this specific bug doesn't touch Gmail users. But the underlying lesson generalizes: the inbox is not a passive reading surface, it's an execution environment that a hostile sender partially controls. Webmail platforms like Zimbra and Roundcube have both had rendering bugs that sat unnoticed for years before someone weaponized them—a reminder that "opening an email" carries more risk than most users assume, regardless of which platform sits behind it.

Two weeks after this patch, an international advisory confirmed the worry was not hypothetical: Russian state supported hackers had been reading 90 days of victims' email through a separate Zimbra rendering flaw, with no click required at all.

How Do I Protect My Inbox?

If you administer Zimbra Collaboration Suite:

• Upgrade to ZCS 10.1.19 immediately. Zimbra published patch instructions and release notes covering the zimbra-patch and zimbra-mbox-webclient-war packages.
• If you can't patch right away, restrict or disable Classic Web Client access and push users to the Modern UI, which this advisory does not implicate.
• Audit mailbox logs for anomalous script content in received messages, especially from external senders, and treat any TAG attributed disclosure as a signal to check for prior compromise, not just future risk.
• Brief end users at organizations still on Classic Web Client to avoid opening messages from unfamiliar external senders until the upgrade is confirmed, and to report anything visually odd about a rendered message.

If you're a Gmail user with no connection to Zimbra, there's no direct action here—but it's a good prompt to remember that opening an email is not an inherently neutral act. Hostile senders can embed more than links and attachments inside a message; some platforms let them embed behavior. That's the same reasoning behind tools like Gblock that strip out what a sender tries to trigger silently the moment you open their message—a different mechanism than XSS, but the same category of threat: your inbox acting on someone else's instructions before you've decided to trust them.