26 September 2026
Reference: CVE-2023-37580
1. What is being reported?
The vulnerability affects Zimbra Collaboration versions before 8.8.15 Patch 41, specifically in the classic web email client. It allows cross-site scripting (XSS), meaning attackers can inject harmful scripts into emails viewed by users.
2. What this means in plain English
If exploited, this flaw could let attackers manipulate emails you receive or send, potentially leading to fraud, misinformation, or unauthorised access. For small organisations relying on Zimbra for email, this could disrupt trust and security in daily communications.
3. Could this affect a small business?
Small businesses using older versions of Zimbra Collaboration with the classic web client may be at risk. Those using updated versions or different email systems are likely not affected. If unsure, check with your IT provider.
4. What to do now
- Check which version of Zimbra Collaboration your organisation uses.
- If using a version before 8.8.15 Patch 41, arrange to update to the latest patch as soon as possible.
- Inform staff to be cautious about unexpected or unusual emails, especially those with links or attachments.
- Consult your IT provider to confirm your email system is secure and patched.
5. Ask your IT provider
Can you confirm if our Zimbra Collaboration email system is updated past version 8.8.15 Patch 41 to protect against the recent XSS vulnerability?
6. Bottom line
Keep your email software up to date to prevent attackers from tampering with your business communications.
Information based on CISA KEV, NVD, and reputable security reporting.