What happened
Zimbra has issued an urgent patch for a critical stored cross-site scripting vulnerability in its Classic Web Client that allows specially crafted incoming emails to trigger malicious scripts within an authenticated user's browser session — potentially handing attackers full control of that session. The flaw has not yet received a CVE designation, but Zimbra's own advisory characterizes it as severe enough to warrant immediate remediation. Separately, investigative reporting from Krebs on Security has exposed a cybersecurity startup that markets itself as a premium buyer of zero-day exploits while being operated by two convicted felons with histories of running fraudulent intelligence firms and AI-based lobbying platforms under assumed identities.
Why it matters for your business
Organizations running Zimbra Classic Web Client should treat this as a priority patching event: a stored XSS flaw means a single malicious email reaching any inbox can compromise an entire authenticated session without any additional user interaction beyond opening the message. For operations teams, the practical step is straightforward — apply Zimbra's update immediately and audit mail-filtering rules that might allow unusual HTML or script payloads. The fraudulent zero-day broker story carries a subtler but equally serious warning: security vendors and researchers who sell or share vulnerability intelligence must vet counterparties rigorously. Engaging with illegitimate brokers could expose organizations to legal liability, reputational damage, and the real risk that acquired exploits end up in criminal hands rather than being responsibly disclosed.
What to watch next
A CVE identifier for the Zimbra flaw is expected to be assigned shortly, which will likely trigger broader scanning activity by threat actors — making the patch window narrower than it may appear today. On the broker front, regulators and law enforcement have shown increasing interest in the zero-day marketplace, and the exposure of this particular operation may accelerate scrutiny of the wider exploit-acquisition industry. Security leaders should monitor both threads closely over the coming weeks.