CISA Adds Actively Exploited Zimbra XSS Zero-Day (CVE-2025-27915) to KEV Catalog

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a new zero-day vulnerability, CVE-2025-27915, to its Known Exploited Vulnerabilities (KEV) catalog on October 7, 2025. This action confirms that the flaw is being actively exploited in the wild. The vulnerability is a high-severity (CVSS 7.5) stored cross-site scripting (XSS) issue affecting the Classic Web Client of Synacor's Zimbra Collaboration Suite (ZCS). Exploitation requires no user interaction other than the victim's mail client opening or viewing a specially crafted email containing a malicious calendar invite. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session, leading to account compromise. Federal agencies must apply mitigations by October 28, 2025.

Vulnerability Details

CVE-2025-27915 is a stored XSS vulnerability that arises from insufficient sanitization of HTML content within iCalendar (.ics) files. The ZCS Classic Web Client fails to properly neutralize malicious code embedded in calendar invitations.

Technical Description

An attacker can craft a malicious .ics calendar appointment containing a <details> HTML tag with an ontoggle JavaScript event handler. This malicious appointment is then emailed to a target. When the victim's Zimbra web client renders or previews the email, the ontoggle event is triggered automatically, executing the embedded JavaScript payload. This occurs without the user needing to click any links or explicitly accept the invitation.

Once the script executes, the attacker has control over the victim's authenticated web session, enabling them to perform any action the user can.

Affected Systems

• Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1
• Specifically, the Classic Web Client is affected.

Exploitation Status

The vulnerability is a zero-day and is confirmed by CISA to be under active exploitation. The low complexity and lack of required user interaction make it a potent tool for attackers targeting organizations that use Zimbra for their email services, which often includes government and educational institutions.

Impact Assessment

Successful exploitation of CVE-2025-27915 can lead to a full compromise of a user's email account. The impact includes:

• Data Exfiltration: Attackers can read, forward, and steal all emails from the compromised account, including sensitive corporate data and personal information. (T1114.001 - Local Email Collection)
• Session Hijacking: The attacker can use the active session to impersonate the user, send emails on their behalf, and access other integrated applications.
• Persistence and Lateral Movement: Attackers can create malicious email forwarding rules to continuously exfiltrate new incoming emails to an external address. They can also use the compromised account to launch further phishing attacks against other employees. (T1114.003 - Email Forwarding Rule)

Cyber Observables for Detection

Detection should focus on identifying malicious .ics files and subsequent anomalous account activity.

Detection Methods

1. Email Gateway Scanning: Configure email security gateways to scan the content of .ics attachments for malicious HTML tags like <details> and ontoggle. Use D3FEND's File Content Rules to block these threats.
2. Audit Log Review: Regularly audit Zimbra audit logs for suspicious activities, such as unexpected changes to account settings, new filter creation, or logins from unusual IP addresses immediately following the receipt of a calendar invite.
3. WAF Rules: If possible, implement a Web Application Firewall (WAF) rule to inspect and sanitize content rendered by the Zimbra web client, although this can be complex.

Remediation Steps

As this is an actively exploited zero-day, immediate action is required.

1. Apply Mitigations: Zimbra has not yet released a full patch, but has provided mitigation guidance. This typically involves manually sanitizing the input or disabling the vulnerable component. Federal agencies are required to apply these vendor-supplied mitigations by October 28, 2025. This is a form of D3FEND Application Configuration Hardening.
2. Switch to Modern Web Client: If feasible, advise users to switch from the 'Classic Web Client' to the 'Modern Web Client', which is not affected by this specific vulnerability.
3. Review Accounts for Compromise: Administratively review all user accounts for unauthorized forwarding rules, delegated permissions, or other signs of compromise.