Vulnerability
Campaign
Security Patch Release
Zimbra calendar-attachment XSS abuse
Updated 06.10.2025 23:12
Case score 64
Score breakdown
- Total
- 64
- Lead score
- 62
- Support bonus
- +2 / 20
- Scoring support
- 1
- Context members
- 1
Top contributors
- Vulnerability Base event: **CVE-2025-27915** in **Zimbra Collaboration Suite** with malicious ICS attachment abuse. base
- Campaign Targeted espionage campaign using the same CVE against the **Brazilian military**; adds support evidence. support
- Security Patch Release Vendor fix for **CVE-2025-27915**; remediation context only. context
Case score 64
Members 3
Latest activity 06.10.2025 23:12
Active exploitation
Patch available
CVSS: 5.4 Medium
Active exploitation
Patch available
CVSS: 5.4 Medium
Members 3
First seen 05.10.2025 17:45
Last seen 06.10.2025 23:12
Updated 06.10.2025 23:12
Overview
Malicious **ICS** attachments exploited **CVE-2025-27915** in **Zimbra Collaboration Suite**, and one operation spoofed the **Libyan Navy's Office of Protocol** to reach the **Brazilian military**. The payload ran JavaScript inside authenticated webmail sessions, creating a path to mailbox abuse, credential theft, and message exfiltration.
**Zimbra** released **9.0.0 Patch 44**, **10.0.13**, and **10.1.5** on January 27, 2025. Available evidence points to targeted espionage activity before the fix, while the exact scope of affected users and any broader spread remain unknown.
Attackers used malicious ICS email attachments to exploit **CVE-2025-27915** in **Zimbra Collaboration Suite**, and one campaign spoofed the **Libyan Navy's Office of Protocol** while targeting the **Brazilian military**. The flaw was a stored XSS issue in the Classic Web Client caused by insufficient sanitization of HTML content in ICS calendar files. When the attachment was opened, embedded JavaScript ran inside the victim's authenticated webmail session and could alter mailbox behavior without a separate password break-in. Observed objectives included credential theft, email and contact theft, shared-folder access, and forwarding-rule changes that could move messages to attacker-controlled destinations.
Zimbra released **9.0.0 Patch 44**, **10.0.13**, and **10.1.5** on January 27, 2025 to close the vulnerable path. Available evidence places exploitation before that fix, and the exact number of affected users or organizations is not available. The current record is a targeted espionage-style operation against a military victim, but broader reach and any successful post-exploitation remain unconfirmed.