Loading vulnerability…
Stored XSS in Zimbra Classic Web Client ICS Processing
CVE-2025-27915 is a stored cross-site scripting vulnerability affecting the Classic Web Client in Zimbra Collaboration Suite 9.0, 10.0, and 10.1. Insufficient sanitization of HTML in iCalendar (ICS) entries allows attacker-supplied JavaScript to execute through an ontoggle event handler on a details element when a user views a malicious email. The script runs in the victim's authenticated webmail session, enabling unauthorized mailbox access, account-setting changes, email forwarding, and data exfiltration.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality and integrity of the victim's mailbox and accessible collaboration data. Malicious JavaScript can retrieve emails, contacts, distribution lists, and shared-folder content through Zimbra APIs, manipulate mail filters to forward messages externally, and capture credentials through injected login fields. Observed payloads also targeted backup authentication codes, trusted-device information, and app-specific passwords, potentially supporting continued unauthorized access. This vulnerability provides browser-side JavaScript execution, not inherently server-side code execution.
If you can’t patch tonight, do this now.
Until patching is complete, consider temporarily restricting access to the affected Classic Web Client and filtering or quarantining untrusted ICS calendar attachments at the mail gateway. These are exposure-reduction measures, not confirmed vendor workarounds. Monitor mailbox filter changes, unexpected external forwarding, unusual account access, and anomalous mailbox retrieval activity. Avoid viewing suspicious calendar messages in the affected client.
Patch, then assume compromise.
Upgrade affected installations to a currently supported Zimbra release that includes the vendor's fix for CVE-2025-27915 and its strengthened ICS HTML sanitization. The available information gives conflicting minimum fixed versions, including 10.1.5 and 10.1.9; verify the applicable fixed release against Zimbra's vulnerability-specific release notes rather than relying solely on version-based detection. For potentially compromised accounts, remove unauthorized forwarding filters, revoke active sessions and compromised authentication artifacts, and reset exposed credentials.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
72 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.