CVE entry · CVE-2025-27915
CVE-2025-27915: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
- Actively exploited: added to CISA’s KEV catalog on October 7, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: October 28, 2025.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Synacor Zimbra Collaboration Suite (ZCS), including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
Other Synacor vulnerabilities
-
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
-
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
-
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
-
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
-
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability