NOTABLENATOA2vulnerability

Zimbra Classic Web Client: crafted-email code execution fixed in ZCS 10.1.19, surfaced by NCSC-CH (no CVE, exploitation unknown)

NCSC-CH flags a Zimbra Classic Web Client flaw where opening a crafted email runs script in the webmail session, patch to ZCS 10.1.19

first published 2026-07-10 20:34 UTC

Defender actions

Identify Zimbra tenants still using the Classic Web Client and upgrade to ZCS ≥ 10.1.19; as an immediate interim step, move users to the Modern Web Client, which is not affected.
Prioritise internet-facing Zimbra webmail; the flaw is unauthenticated and triggers on message open, so exposure is proportional to who can send mail to affected mailboxes.

Analysis

Zimbra released ZCS 10.1.19 on 2026-07-07 to fix a Classic Web Client issue in which "a specially crafted email could run malicious code when the email is opened," potentially granting access to mailbox information, session data or account settings (Zimbra, 2026-07-07); heise online covered it the same day as a stored cross-site-scripting flaw in the legacy webmail UI (heise online, 2026-07-07). Switzerland's NCSC-CH added the item to its Cyber Security Hub on 2026-07-10, describing it as allowing unauthenticated remote attackers to reach session data, account settings and mailbox contents when a victim opens a malicious email, and explicitly recording the exploitation status as unknown (NCSC-CH / GovCERT.ch, 2026-07-10). Only the Classic Web Client is affected; Zimbra and heise recommend switching users to the Modern Web Client as an interim mitigation.

Defender takeaway

The observable behavior is client-side script execution inside an authenticated webmail session triggered by message rendering, in webmail/application logs and browser telemetry, watch for anomalous outbound requests or session-token access originating from the webmail origin immediately after a message is opened, and for mailbox operations (rule creation, forwarding, bulk reads) that follow such a sequence. Triage: legitimate HTML mail renders inline content routinely, so a single rendered message is not the signal; the discriminator is script execution that reaches the session store or drives mailbox/account-setting changes rather than merely displaying content. The honest caveats are that no CVE has been assigned and no exploitation has been confirmed; the actionable reason to move now is that a national authority for the constituency chose to publish it and the affected surface is an unauthenticated, on-open path in a webmail platform still used across European public-sector and telecom environments.

Cited evidence

The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened. If exploited, it could allow access to mailbox information, session data, or account settings.

Zimbra 2026-07-07

Current exploitation status: UNKNOWN

NCSC-CH / GovCERT.ch 2026-07-10

Sources3

Zimbraprimary · 2026-07-07 NCSC-CH / GovCERT.chcorroborating · 2026-07-10 heise onlinecorroborating · 2026-07-07

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.

Key facts

Affected products

Zimbra Collaboration Suite Classic Web Client

Assessment

NATOA2NATO Admiralty code

Source reliabilityA Completely reliable

Info credibility2 Probably true

Verificationmulti-source

Confidencemedium

No CVE assigned by Zimbra or NCSC-CH as of this run; NCSC-CH lists exploitation status as unknown (no confirmed in-the-wild abuse). Zimbra rates the patch severity High and deployment risk Low. Included on the strength of the home-region national authority (NCSC-CH) issuing its own advisory for the constituency; the client-side, no-CVE, unknown-exploitation profile is why confidence is medium and priority is notable, not high.

ATT&CK techniques

T1059.007 Command and Scripting Interpreter: JavaScript T1203 Exploitation for Client Execution T1539 Steal Web Session Cookie

Regions

switzerland europe

Sectors

public-sectortelco

Record

Published2026-07-10 20:34 UTC

Event date2026-07-07

Sources3

Raw sourceindex.md

Produced by2026-07-10T2009Z-intel