The Hacker News34%
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions 49%
By https:49% www.facebook.com54% thehackernews53% The Hacker News58%
7/11/2026, 1:06:34 PM
BS Summary: This article contains 1 faulty reasoning type, including Indoctrination, with Indoctrination as the most egregious example at 8.2% saturation with 58 hits. Analysis detected 58 faulty-reasoning hits from 708 analyzed words, generating a BS Score of 51.5% and a BS Rank of 49% (7,188 of 14,081 articles). This article is better (less manipulative) than 51.00% of the article peer group.
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions
Ravie Lakshmanan Jul 11, 2026 Vulnerability / Email Security
Zimbra is urging customers to apply updates to address a critical security vulnerability impacting the Classic Web Client that could result in arbitrary code execution.
The vulnerability has been described as a case of stored cross-site scripting (XSS) that could allow specially crafted emails to execute malicious scripts in a user's session.
It has yet to be assigned a CVE identifier.
"The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened," Zimbra said .
"If exploited, it could allow access to mailbox information, session data, or account settings."
XSS vulnerabilities occur when an application includes untrusted data in a web page without proper validation or escaping.
This allows attackers to inject and execute malicious JavaScript in victims' browsers, which can result in session hijacking, credential theft, and account compromise.
Stored XSS, or persistent XSS, is a type of XSS flaw where the injected script is permanently stored on the target servers in a database in the form of a seemingly harmless comment or a forum post, causing any site visitor to be compromised as soon as the page containing the JavaScript is loaded on their web browser.
Although Zimbra makes no mention of the vulnerability being exploited in the wild, XSS flaws in Zimbra have been an attack magnet for years, with bad actors attempting to weaponize such vulnerabilities as far back as December 2021.
Last October, a stored XSS flaw in the Classic Web Client ( CVE-2025-27915 , CVSS Score: 5.4) was alleged to have been exploited as a zero-day in attacks targeting the Brazilian military, although Zimbra told The Hacker News at the time that it found no evidence to back it up.
Other XSS flaws that have been exploited by threat actors include CVE-2023-37580 and CVE-2024-27443 .
Given its high potential for abuse, users are recommended to update to Zimbra Collaboration Suite version 10.1.19 for optimal protection.
Found this article interesting?
Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.
Application Security , browser security , Code Execution , Cross-site Scripting , email security , enterprise security , Vulnerability , Web Security
16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA
Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker
Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code
New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware
GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents
Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It
Meta's New AI Image Tool Lets Others Use Your Public Instagram Photos in AI Images
ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories
Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets
Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers
Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws
New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions
Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices
New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices
European Parliament Member Investigating Spyware Was Hacked With Pegasus
⭐ Featured Resources
What 200+ Security Teams Reveal About Using IP Intelligence in 2026
Get Hands-On SANS Training for Today’s Cyber Defense and Offensive Security Challenges
See What’s Really Exposed Across Your IT, OT, IoT, Cloud, and Mobile Assets
Get Gartner’s Guide to AI Agent Supervision and Runtime Controls
Voice attribution · Experimental
Who is speaking?
See where attributed voices appear and how each speaker's manipulation signature differs from the writer's voice.
1speaker5.9%attributed speech666writer words
Voice mapSelect a segment to jump to its words
Selected voice
0%flagged-word coverageZimbra
42 attributed words100% of attributed speech8.7% writer coverage
Indoctrination-8.7 pts
Writer 8.7%Zimbra 0%
Attribution is sentence-level. Pattern percentages are calculated only from words assigned to that voice.
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.