A patch note that reads like a countdown
The advisory from Zimbra was short and specific. Anyone running the Classic Web Client in Zimbra Collaboration should move to release 10.1.19, and move soon. The company framed the flaw as critical, the strongest word it uses, and left most of the reasoning to the reader.
For an administrator opening that note on a Monday morning, the meaning is plain. A mail platform that sits at the center of an organization has a hole in the part of it that renders messages, and the clock on fixing it is already running.
What the flaw actually does
The bug is a stored cross-site scripting flaw. An attacker sends a specially crafted email, and when the recipient opens it in the Classic Web Client, attacker-controlled code executes inside the browser session instead of staying inert text. From there it can read session data, account settings, and mailbox contents.
No click on a link is required beyond opening the message, and there is no malware to install. The victim simply reads their email. Zimbra fixed the issue in 10.1.19, and no CVE identifier has been assigned yet, which is common in the first days after a vendor patch.
Why Google's fingerprint resets the clock
The detail that should change the urgency is who reported the flaw. It was Google's Threat Analysis Group, the unit that tracks state-backed intrusion and attacks on high-risk users. TAG does not usually surface routine bugs, so its involvement signals a flaw with a plausible espionage use.
Zimbra has a long record here. State-linked crews including APT28, APT29, and Winter Vivern have weaponized earlier Zimbra flaws against government, military, and diplomatic mailboxes, and against Ukrainian targets, often within weeks of disclosure. This flaw is not yet tagged as exploited in the wild, but that history is why the gap between patch and exploit tends to be short.
The Classic client is the whole exposure
Only the Classic Web Client, also called the Classic UI, is affected. The newer interface is not the target. That sounds like a narrowing of risk, and in one sense it is, but it hides a trap: many organizations left the Classic client switched on so that long-time users could keep the layout they knew.
That legacy toggle is now the attack surface. Before patching, the honest question for an operator is not whether Zimbra is deployed but who inside the organization still lands on the Classic interface, because those are the accounts a crafted email would reach first.
What to do before the exploit code lands
The direct fix is to upgrade to ZCS 10.1.19. Where an immediate upgrade is not possible, disabling the Classic Web Client removes the exposed surface until the update can be scheduled, and treating unsolicited mail to webmail users as higher risk buys a little margin.
European public bodies and telecom operators make up a large share of Zimbra's installed base, and they are also the profile state actors have gone after before. For them the priority order is simple: patch now, confirm the Classic client is gone, then check the logs for anything that arrived before the fix did.
Read next: Progress tells ShareFile users to pull the plug | A Defender Flaw Lets a Local User Take Over the PC
