Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

Zimbra has identified a critical security vulnerability in its Classic Web Client that could allow arbitrary code execution. The issue is a stored cross-site scripting vulnerability that can be triggered by specially crafted emails, enabling malicious scripts to run in a user's session. Zimbra is advising customers to apply updates to address this flaw. The vulnerability has not been assigned a CVE identifier yet. This security issue could potentially be exploited to execute malicious code. Zimbra users are at risk if they receive and interact with maliciously crafted emails.