Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Zimbra Collaboration Suite XSS flaw (CVE-2025-27915)

Vulnerability
First reported
Last updated
Happening score
H score 47
3 unique sources, 3 articles

Summary

Hide ▲

CVE-2025-27915 was exploited as a zero-day in Zimbra Collaboration Suite (ZCS 9.0, 10.0, and 10.1), exposing users to JavaScript execution inside authenticated webmail sessions. The flaw came from insufficient sanitization of HTML content in ICS calendar files, which let attackers weaponize .ICS attachments as an execution vector. Zimbra later released ZCS 9.0.0 P44, 10.0.13, and 10.1.5 on January 27, 2025, after attacks had already started in early January.

Cases

Zimbra calendar-attachment XSS abuse (3)

Related Happenings

APT28 Operation GhostMail Zimbra phishing campaign targeting Ukrainian government entities

Campaign
H score37 First: 19.03.2026 16:55 Last: 19.03.2026 16:55 Sources 1

About this happening: APT28’s Operation GhostMail is actively targeting Ukrainian government entities through a phishing chain that exploits CVE-2025-66376 in Zimbra Collaboration Sui...

Open Happening

CISA adds two Roundcube flaws to KEV catalog

Public Sector Action
H score49 First: 21.02.2026 09:21 Last: 21.02.2026 09:21 Sources 1

About this happening: CISA added two Roundcube webmail flaws to the KEV catalog after citing active exploitation, increasing urgency for federal remediation. CVE-2025-49113 is a C...

Open Happening

CISA KEV multi-product active exploitation wave (CVE-2020-7796)

Exploitation Wave
H score53 First: 18.02.2026 08:52 Last: 18.02.2026 08:52 Sources 1

About this happening: CISA expanded its KEV catalog with four actively exploited flaws, signaling a live exploitation wave across Chrome, TeamT5 ThreatSonar, Zimbra, and Windows Video Act...

Open Happening

CISA SmarterMail remediation guidance for CVE-2026-24423

Advisory/Mitigation
H score86 First: 06.02.2026 19:16 Last: 06.02.2026 19:16 Sources 1

About this happening: SmarterMail is at the center of a CVE-2026-24423 remediation and exploitation wave: the flaw enables unauthenticated remote code execution in versions prior to Build...

Open Happening

CISA KEV remediation deadline for SolarWinds WHD CVE-2025-40551

Public Sector Action
H score53 First: 04.02.2026 07:50 Last: 04.02.2026 07:50 Sources 1

About this happening: CISA added CVE-2025-40551 in SolarWinds Web Help Desk to the KEV catalog and imposed federal remediation deadlines, turning a newly exploited flaw into a compl...

Open Happening

Timeline

  1. 05.10.2025 17:45 1 articles · 9mo ago

    Zimbra releases fixes for CVE-2025-27915

    Mitigation Patch Update

    Zimbra released ZCS 9.0.0 P44, 10.0.13, and 10.1.5 on January 27, 2025 to address CVE-2025-27915, a cross-site scripting flaw in Zimbra Collaboration Suite caused by insufficient sanitization of HTML content in ICS files that allowed arbitrary JavaScript execution inside Zimbra Webmail sessions.

    Show sources
    Open in new tab
  2. 05.10.2025 17:45 4 articles · 9mo ago

    StrikeReady identifies Zimbra zero-day exploitation through ICS attachments

    Initial Disclosure

    StrikeReady identified zero-day exploitation of CVE-2025-27915 in Zimbra Collaboration Suite (ZCS 9.0, 10.0, and 10.1) through .ICS/iCalendar email attachments that delivered Base64-obfuscated JavaScript; the campaign spoofed the Libyan Navy’s Office of Protocol, targeted a Brazilian military organization, and sought to steal Zimbra Webmail credentials, emails, contacts, and shared folders while adding forwarding filters.

    Show sources
    Open in new tab