CVE-2025-27915

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting

5.4 MEDIUMActively exploited (CISA KEV)Public exploitEPSS 4.06%

Published12 Mar 2025
Added to CISA KEV7 Oct 2025
Remediation due28 Oct 2025

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

Added to KEV: 7 Oct 2025Federal remediation due: 28 Oct 2025

Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

ScopeChanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

Synacor Zimbra Collaboration Suite≥ 10.0.0 < 10.0.13 · ≥ 10.1.0 < 10.1.5 · 9.0.0

Remediation

Fixed in

Synacor Zimbra Collaboration Suite≥ 10.0.13

References

https://strikeready.com/blog/0day-ics-attack-in-the-wild/ExploitThird Party Advisory
https://wiki.zimbra.com/wiki/Security_CenterRelease Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_FixesRelease Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_FixesRelease Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_FixesRelease Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-27915 being actively exploited?

Yes. CVE-2025-27915 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 7 Oct 2025.

How severe is CVE-2025-27915?

CVE-2025-27915 has a CVSS 3.1 base score of 5.4, rated medium. EPSS estimates a 4.06% probability of exploitation.

Which products are affected by CVE-2025-27915?

Affected products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2025-27915?

Upgrade affected software to a fixed version, for example Synacor Zimbra Collaboration Suite 10.0.13 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-27915 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.