Actively Exploited Zimbra XSS Leaves Over 10,000 Servers Exposed
Active Exploitation · 2 sources · Updated 4mo ago · First seen Apr 24, 2026
More than 10,000 internet-exposed Zimbra Collaboration Suite servers remain vulnerable to CVE-2025-48700, an actively exploited cross-site scripting flaw that affects ZCS versions 8.8.15, 9.0, 10.0, and 10.1. The bug lets unauthenticated attackers execute arbitrary JavaScript in a victim’s session and steal sensitive data when a user opens a malicious email in the Zimbra Classic UI. Synacor released patches in June 2025, but Shadowserver still reported roughly 10,500 exposed unpatched systems, with the largest concentrations in Asia and Europe.
CISA has added CVE-2025-48700 to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to secure affected servers within days because the flaw is being abused in the wild. The warning follows a broader pattern of Zimbra vulnerabilities being used in espionage-focused campaigns, with reporting linking earlier exploitation of similar flaws to Russian-aligned groups including APT28, APT29, and Winter Vivern against Ukrainian entities, NATO-aligned organizations, and other targets.
