The vulnerability allows an unauthenticated calendar sender to inject active markup into the RFC From address of a COUNTER message. When the recipient opens that message in Zimbra Classic, the injected code executes in the victim’s browser, giving the attacker the ability to read mailbox contents and perform actions as the user. The issue is a classic stored XSS flaw categorized as CWE‑79. No additional network or privilege escalation beyond the web client is required.

The affected product is the Zimbra Collaboration Suite (ZCS) Classic Web Client. Specific version information is not disclosed in the advisory, so all current installations that support the Classic interface should be considered vulnerable until a patch is applied.

The CVSS base score of 9.3 reflects a high‑severity flaw, and because the attacker only needs to send a malicious calendar invite, the probability of exploitation is significant despite the EPSS score not being published. The vulnerability is not yet listed in the CISA KEV catalog, but its high severity and ease of execution warrant prompt action. Attackers would craft and deliver a COUNTER message containing malicious markup; upon opening, the stored XSS would fire, allowing browser‑based compromise of the victim’s mailbox.