CVE-2023-37580: Zimbra Classic Web Client XSS in ZCS 8

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is confirmed exploited in the wild per CISA KEV and carries a high EPSS score, though its CVSS base score is only medium and it requires user interaction.

What it is

Zimbra Collaboration Suite 8 before 8.8.15 Patch 41 contains a cross-site scripting flaw in the Classic Web Client. Because the client renders attacker-influenced content, a crafted payload can execute script in a victim's authenticated session, which matters for a widely deployed mail and collaboration platform.

Impact

An attacker can run script in the context of a logged-in Zimbra user, enabling session or credential theft and actions performed as that user. The CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network through the Classic Web Client; the vector shows no privileges required (PR:N) but user interaction is required (UI:R), so a victim must be induced to view or click crafted content. No authentication is needed to deliver the payload, though the victim is typically an authenticated user.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2023-07-27, confirming real-world exploitation, and EPSS is high at roughly 0.467 (98.8th percentile). No ransomware campaign use is documented in the record.

What to do

• Upgrade Zimbra Collaboration Suite 8 to 8.8.15 Patch 41 or later as the primary fix.
• If patching is not immediately possible, apply the vendor mitigations referenced in the CISA KEV required action or discontinue use of the product.
• Enforce the CISA KEV remediation deadline of 2023-08-17 for exposed instances.
• Restrict network exposure of the Zimbra web client and require MFA to limit session abuse.
• Review Zimbra accounts for signs of compromise after any suspected exposure.

Detection

• Inspect web and proxy logs for requests to the Classic Web Client containing script-like payloads or unusual encoded parameters.
• Monitor for anomalous authenticated Zimbra session activity, such as unexpected mailbox rules, forwarding, or logins from new locations.
• Hunt for outbound connections or content loads from the client that do not match normal Zimbra usage patterns.
• Alert on Zimbra version banners indicating builds earlier than 8.8.15 Patch 41.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.