U.S. CISA adds Synacor Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog

According to Security Affairs, U.S. CISA added Synacor Zimbra Collaboration Suite (ZCS) flaw CVE-2025-27915 to its Known Exploited Vulnerabilities catalog, underscoring the ongoing risks to organisations using Zimbra versions 9.0–10.1 from improper HTML sanitisation in ICS attachments. The stored XSS vulnerability is triggered when victims open an email containing a malicious ICS entry, allowing JavaScript to execute via an <ontoggle> event and enabling session hijacking, email redirects and data exfiltration.

StrikeReady researchers found that threat actors exploited CVE-2025-27915 in zero‑day attacks using malicious iCalendar files, which were weaponised to deliver JavaScript payloads; these attacks stolen credentials, emails, contacts and items from shared folders and exfiltrated data to ffrk[.]net. The malware reportedly forwards messages to a ProtonMail address and employs evasion techniques, including a 60‑second execution delay and a three‑day operational window.

The researchers could not attribute the attack to a specific group, but noted TTPs similar to those tied to the Belarusian APT group UNC1151, with CISA mandating that federal agencies fix the vulnerabilities by 28 October 2025 according to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities.