CISA Alerts on Zimbra Collaboration Suite Zero-Day XSS Flaw Exploited in Ongoing Attacks

CISA alerts on a new zero-day cross-site scripting flaw in Zimbra Collaboration Suite (ZCS), which is already being used by attackers to hijack user sessions, steal data, and push malicious filters. The vulnerability stems from insufficient sanitisation of HTML in ICS calendar files viewed in the Classic Web Client, allowing an attacker to embed JavaScript in an ICS entry that executes when a user opens a malicious invitation.

The CVE is CVE-2025-27915, and the flaw affects all supported ZCS versions that include the Classic Web Client; the CVSS score is 7.5, indicating high severity. According to CISA, this flaw was added to the Known Exploited Vulnerabilities Catalog on 7 October 2025, with an action deadline of 28 October 2025, and administrators are urged to apply patches or workarounds and disable the Classic Web Client if mitigations are unavailable.

Timely patching and monitoring are emphasised to stop attackers from exploiting this flaw, and organisations are advised to review vendor advisories and follow guidance for cloud-hosted deployments. The article notes the issue is being exploited in ongoing attacks and that users and security teams should tighten email attachment policies and scrutinise ICS file attachments.