Email security provider **Zimbra** has released an urgent patch for its **Classic Web Client**, addressing a critical security vulnerability that could lead to arbitrary code execution. The flaw, a stored Cross-Site Scripting (XSS) vulnerability, allows malicious scripts to run within a user's session when a specially crafted email is opened. While it has not yet been assigned a **CVE** identifier, **Zimbra** has confirmed its severity. "The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened," **Zimbra** stated. "If exploited, it could allow access to mailbox information, session data, or account settings." XSS vulnerabilities occur when web applications display untrusted data without adequate validation or sanitization. This oversight enables attackers to inject and execute malicious JavaScript in a victim's browser, potentially leading to session hijacking, credential theft, and full account compromise. Stored XSS, also known as persistent XSS, is particularly dangerous as the malicious script is permanently embedded on the target server, often disguised within benign content like comments or forum posts. This means any user who views the compromised page automatically becomes a target. Although **Zimbra** has not indicated active exploitation of this specific vulnerability, XSS flaws in its platform have historically been a prime target for threat actors. Incidents dating back to December 2021 show attackers consistently attempting to weaponize such vulnerabilities. Last October, a stored XSS flaw in the Classic Web Client, identified as **CVE-2025-27915** (CVSS Score: 5.4), was reportedly exploited as a zero-day against the Brazilian military. However, **Zimbra** maintained at the time that it found no conclusive evidence to support these claims. Other notable XSS vulnerabilities exploited by threat actors include **CVE-2023-37580** and **CVE-2024-27443**. Given the high potential for abuse, **Zimbra** strongly advises all users to update to **Zimbra Collaboration Suite version 10.1.19** to ensure optimal protection against this and other known threats.