Zimbra calendar-attachment XSS abuse

**CVE-2025-27915** was exploited as a **zero-day** in **Zimbra Collaboration Suite (ZCS 9.0, 10.0, and 10.1)**, exposing users to **JavaScript execution** inside authenticated webmail sessions. The flaw came from **insufficient sanitization of HTML content in ICS calendar files**, which let attackers weaponize **.ICS attachments** as an execution vector. Zimbra later released **ZCS 9.0.0 P44, 10.0.13, and 10.1.5** on **January 27, 2025**, after attacks had already started in **early January**.

An **unknown threat actor** impersonating the **Libyan Navy's Office of Protocol** targeted the **Brazilian military** in a **targeted espionage campaign**, using a malicious **ICS email attachment** to deliver an exploit against **Zimbra**. The operation mattered because the attachment triggered **zero-day** exploitation in a collaboration platform rather than a standard phishing lure or server compromise. The delivery chain enabled data theft from user sessions, including **credentials** and mail content, while helping the actor avoid detection. The activity occurred **earlier this year** and was tied to **CVE-2025-27915**.

**Zimbra Collaboration** released **security fixes** for **CVE-2025-27915**, closing a **stored XSS** flaw in the **Classic Web Client** that could enable session abuse and **data exfiltration**. The patch bundle shipped on **January 27, 2025** in **9.0.0 Patch 44**, **10.0.13**, and **10.1.5**. Later reporting linked the flaw to **zero-day** abuse in attacks that used **malicious ICS files**.