CISA Warns of Zimbra Collaboration Suite (ZCS) XSS Zero-Day Vulnerability Actively Exploited in Attacks

CISA has issued a critical warning regarding a zero-day cross-site scripting (XSS) vulnerability in Synacor’s Zimbra Collaboration Suite (ZCS), designated as CVE-2025-27915. 

This vulnerability has been actively exploited in attacks and poses significant risks to organizations using the popular email and collaboration platform.

Zimbra Collaboration Suite (ZCS) XSS Flaw

The vulnerability exists within the Classic Web Client component of Zimbra Collaboration Suite and stems from insufficient sanitization of HTML content in ICS (Internet Calendar System) files. 

The security flaw is classified under CWE-79, which specifically addresses improper neutralization of input during web page generation.

When users view email messages containing malicious ICS entries, embedded JavaScript code executes automatically through an ontoggle event handler within a <details> tag. 

This exploitation vector allows attackers to run arbitrary JavaScript code within the victim’s authenticated session context. 

The attack mechanism bypasses standard security controls by leveraging legitimate calendar file functionality to deliver malicious payloads.

The vulnerability’s exploitation requires minimal user interaction – simply viewing a specially crafted email message triggers the malicious code execution. 

This low barrier to exploitation makes it particularly dangerous for widespread attacks targeting multiple organizations simultaneously.

Risk Factors	Details
Affected Products	Zimbra Collaboration Suite (ZCS) 10.1.9ZCS 10.0.15ZCS 9.0.0 Patch 46
Impact	Cross-site scripting
Exploit Prerequisites	Victim must view a crafted email containing a malicious ICS calendar entry in the Classic Web Client; user interaction required; attacker needs a valid account or email delivery capability
CVSS 3.1 Score	5.4 (Medium)

Mitigations

The successful exploitation of CVE-2025-27915 enables attackers to perform unauthorized actions within compromised user accounts, including the creation of malicious email filters that redirect incoming messages to attacker-controlled addresses. 

This capability facilitates comprehensive data exfiltration and ongoing surveillance of victim communications.

CISA has designated October 28, 2025, as the mandatory remediation deadline for federal agencies under Binding Operational Directive (BOD) 22-01. 

Organizations must apply vendor-provided mitigations, implement applicable cloud service guidance, or discontinue product usage if effective mitigations remain unavailable.

The agency emphasizes that this vulnerability’s active exploitation status requires immediate attention from all Zimbra Collaboration Suite administrators. 

Security teams should monitor the official Zimbra Security Center and National Vulnerability Database for updated mitigation guidance and patches. 

Organizations should also implement additional email security controls, including enhanced attachment scanning and user awareness training focused on suspicious calendar invitations and ICS file attachments.

Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today