CVE-2025-27915

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-27915 5.4

Synacor · Zimbra Collaboration Suite (ZCS) · Added 2025-10-07 · Published 2025-03-12

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilitySynacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

VendorSynacor

ProductZimbra Collaboration Suite (ZCS)

Date added2025-10-07

Due date2025-10-28

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-79

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Descriptions

KEV: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

NVD: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-31 17:41 UTC

Wall time120.0s

Searches4

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-27915
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://strikeready.com/blog/0day-ics-attack-in-the-wild/
https://github.com/runZeroInc/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27915.yaml
https://www.sentinelone.com/vulnerability-database/cve/cve-2025-27915/
https://www.secpod.com/blog/zimbra-flaw-exploited-to-attack-brazils-armed-forces-through-ics-attachments
https://securityaffairs.com/183014/hacking/zimbra-users-targeted-in-zero-day-exploit-using-icalendar-attachments.html
https://hivepro.com/threat-advisory/zimbra-zero-day-hidden-in-harmless-ics-file-targets-military/
https://www.cve.news/cve-2025-27915/
https://github.com/advisories/GHSA-5rg8-g76j-7fw7
https://dbugs.ptsecurity.com/vulnerability/PT-2025-11082
https://zimbra.github.io/documentation/zimbra-10/adminguide.html
https://www.secpod.com/blog/zimbra-flaw-exploited-to-attack-brazils-armed-forces-through-ics-attachments/

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Look for Zimbra mailboxd proxy logs for ICS attachments with Base64-encoded JavaScript calling /service/soap/ModifyFilterRulesRequest or /service/soap/SearchRequest with 60-second delay and data exfiltration to non-Zimbra domains.

Research details

ComponentClassic Web Client ICS parser (HTML sanitizer for iCalendar content rendering - <details> tag ontoggle event handler)

PreconditionsThe attacker must be able to send an email with a crafted ICS (iCalendar) file attachment to a user of a vulnerable Zimbra Collaboration Suite instance (versions 9.0.x before P44, 10.0.x before 10.0.13, or 10.1.x before 10.1.5). The victim must be an authenticated Zimbra user viewing their email through the Classic Web Client (not the Modern Web App). The attack requires user interaction: the victim must open the email containing the malicious ICS attachment. Once viewed, Zimbra's Classic Web Client renders the ICS content in-browser without properly sanitizing HTML embedded in the calendar description field. The attacker exploits the HTML5 <details> element combined with an ontoggle JavaScript event handler. When the victim clicks to expand or collapse the details section (or simply views the email in preview panes that auto-expand), the ontoggle event fires and executes the attacker's JavaScript payload within the victim's authenticated session context. This stored XSS enables the attacker to perform arbitrary actions as the victim, including modifying email filter rules to redirect incoming messages to an attacker-controlled address, exfiltrating contacts and emails via SOAP API calls, and stealing session tokens and credentials. The attack was observed in the wild as a zero-day in January 2025 targeting Brazilian military personnel, with attackers spoofing the Libyan Navy's Office of Protocol. agent

DeliveryThe attack is delivered via email containing a specially crafted ICS (iCalendar) calendar file attachment. The attacker constructs an ICS file following the vCalendar 2.0 format with a VEVENT entry containing a malicious DESCRIPTION field. The DESCRIPTION field contains HTML markup featuring a <details> HTML5 element with an ontoggle JavaScript event handler. For example: '<details ontoggle="fetch('/service/soap/ModifyFilterRulesRequest', {method:'POST', credentials:'include', ...});">Important agenda</details>'. The attacker sends this as an email attachment to the target Zimbra user. When the victim opens the email in Zimbra's Classic Web Client, the ICS file is parsed and rendered inline. Zimbra's sanitization logic fails to strip the <details> element or the ontoggle event handler. When the user interacts with the details disclosure widget (clicks to expand/collapse), the ontoggle event fires and executes the embedded JavaScript in the victim's authenticated browser session. The JavaScript payload can perform SOAP API calls to modify email filter rules (redirecting emails to the attacker), enumerate folders and messages, capture credentials via injected form fields, and exfiltrate stolen data to attacker-controlled servers. In the wild exploit campaign, the malicious JavaScript was heavily obfuscated using Base64 encoding, used a 60-second execution delay for evasion, and limited its activity window to 3 days.

Public PoCyes

PoC URLs https://strikeready.com/blog/0day-ics-attack-in-the-wild/
https://github.com/runZeroInc/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27915.yaml
https://www.cve.news/cve-2025-27915/
https://github.com/advisories/GHSA-5rg8-g76j-7fw7 Third-party repos; verify before use.

Advisoryhttps://wiki.zimbra.com/wiki/Security_Center

Exploit notesCVSS attack complexity: LOW | MEDIUM severity (CVSS 5.4). Exploitation requires crafted ICS file creation and social engineering to deliver via email. No authentication needed to send the malicious email, but the victim must be authenticated to Zimbra Classic Web Client for payload execution.

SummaryCVE-2025-27915 is a stored cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite's Classic Web Client caused by insufficient sanitization of HTML content in ICS calendar file attachments. By embedding a <details> tag with an ontoggle JavaScript event handler in an ICS file's description field, an attacker can execute arbitrary JavaScript in the victim's authenticated session when the email is viewed, enabling email filter manipulation, credential theft, and data exfiltration. This vulnerability was exploited as a zero-day in January 2025 against Brazilian military targets and was subsequently added to CISA's KEV catalog.

Tia coverage

First reported2026-09-24

First exploit report2026-09-24

Exploit report → KEV352 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

when-business-email-compromise-starts-rewriting-reality

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.