CISA Warns of Zimbra Collaboration Suite (ZCS) XSS Zero-Day Vulnerability Actively Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert concerning a critical zero-day cross-site scripting (XSS) vulnerability affecting Synacor's Zimbra Collaboration Suite (ZCS). This vulnerability, identified as CVE-2025-27915 , has been actively exploited and presents significant risks to organizations using this email and collaboration platform.

Zimbra Collaboration Suite (ZCS) XSS Vulnerability

The flaw resides in the Classic Web Client component of the Zimbra Collaboration Suite and is due to insufficient sanitization of HTML content in Internet Calendar System (ICS) files. It is classified under CWE-79, which pertains to improper neutralization of input during web page generation.

When users view email messages containing malicious ICS entries, embedded JavaScript code can automatically execute through an ontoggle event handler within a <details> tag. This allows attackers to execute arbitrary JavaScript code within the user's authenticated session context. The attack mechanism exploits legitimate calendar file functionality to deliver malicious payloads, bypassing standard security controls.

The vulnerability requires minimal user interaction, as merely viewing a specially crafted email message can trigger the malicious code execution. This low barrier to exploitation increases the risk of widespread attacks targeting multiple organizations.

Affected Products: Zimbra Collaboration Suite (ZCS) 10.1.9, ZCS 10.0.15, ZCS 9.0.0 Patch 46 Impact: Cross-site scripting Exploit Prerequisites: Victim must view a crafted email containing a malicious ICS calendar entry in the Classic Web Client; user interaction required; attacker needs a valid account or email delivery capability CVSS 3.1 Score: 5.4 (Medium)

Successful exploitation of CVE-2025-27915 allows attackers to perform unauthorized actions within compromised user accounts, such as creating malicious email filters that redirect incoming messages to attacker-controlled addresses. This capability facilitates data exfiltration and ongoing surveillance of victim communications.

CISA has set October 28, 2025, as the mandatory remediation deadline for federal agencies under Binding Operational Directive (BOD) 22-01. Organizations are advised to apply vendor-provided mitigations, implement applicable cloud service guidance, or discontinue product usage if effective mitigations are unavailable. Immediate attention from all Zimbra Collaboration Suite administrators is required due to the active exploitation status of this vulnerability.

Security teams should monitor the official Zimbra Security Center and National Vulnerability Database for updated mitigation guidance and patches. Additionally, organizations should implement enhanced email security controls, including improved attachment scanning and user awareness training focused on suspicious calendar invitations and ICS file attachments.

Based on reporting by Cyber Security News.