Zimbra XSS Zero-Day (CVE-2025-27915) Actively Exploited; CISA Adds to KEV Catalog

Zimbra XSS Zero-Day (CVE-2025-27915) Actively Exploited; CISA Adds to KEV Catalog has been confirmed as actively exploited in the wild, with specially crafted ICS (iCalendar) attachments used to smuggle executable JavaScript into Zimbra Webmail. StrikeReady observed attacks that abused oversized ICS files and concluded the campaign began at the start of January, prior to Zimbra’s patch release.

The technical root cause was the calendar parser failing to sanitise HTML in ICS payloads, allowing attackers to execute arbitrary JavaScript within a victim’s session and to set filters or forward mail. The malicious ICS carried obfuscated JavaScript that could exfiltrate credentials and other data, and StrikeReady noted the payload’s capability to search folders, retrieve emails and persist beyond initial access.

Synacor released fixes on 27 January in ZCS builds 9.0.0 P44, 10.0.13, and 10.1.5, and, according to CISA, the flaw was added to the Known Exploited Vulnerabilities (KEV) catalog, with Federal Civilian Executive Branch agencies instructed to remediate by 28 October 2025.