If You Use Zimbra Email at Work: Update Needed to Stop Malicious Messages

Zimbra, an email platform used by many businesses and organizations, has a critical security flaw.

Hackers can send specially designed emails that run malicious code when you open them. This happens through what experts call a stored cross site scripting vulnerability. Essentially, bad code gets hidden in an email, and when you view it in your Zimbra inbox, that code activates and can take control of your email session. Zimbra has released an update to fix this problem and is urging all customers to install it immediately. This affects you if your workplace, school, or organization uses Zimbra for email. You might not even know you are using Zimbra, as it often just looks like regular webmail when you log in. The danger is real: opening a malicious email could give hackers access to your entire email account, including all your messages, contacts, and any information you can access through your work email. They could send emails pretending to be you or steal sensitive information from your inbox.

Here is what you need to do:

1. Ask your IT department or email administrator if your organization uses Zimbra email.
2. If yes, ask them to confirm they have installed the latest security update.
3. Be extra cautious about opening emails from unknown senders until the update is confirmed.
4. Do not click links or download attachments from suspicious emails, even if the update is installed.
5. Report any strange email behavior to your IT department immediately. Email security requires teamwork between you and your IT team. While your organization must install updates, you play a role too. Always verify unexpected emails, even from people you know, especially if they ask you to click links or download files. Use different passwords for work and personal accounts. Enable two factor authentication on your email if your organization offers it. Think before you click, and when in doubt, contact the sender through a different method to verify they really sent the message.