{"id":"CVE-2025-27915","published":"2025-03-12T15:15:39Z","modified":"2026-06-17T09:04:22Z","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability","vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","tier":"core","eol":null,"description":{"text":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.","provenance":"source","from":"NVD"},"summary":{"text":"A stored cross-site scripting flaw in the Classic Web Client of Synacor's Zimbra Collaboration Suite (ZCS) arises from insufficient sanitization of HTML content in ICS files. An attacker who gets a user to open an email containing a malicious ICS entry, which requires only that the attacker can send the message and the victim must view it, can run arbitrary JavaScript in the victim's session to perform unauthorized account actions such as creating email filters that redirect messages to an attacker-controlled address or exfiltrating data.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:47Z"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.04064,"percentile":0.90638,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-10-07","dueDate":"2025-10-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://wiki.zimbra.com/wiki/Security_Center ; https://nvd.nist.gov/vuln/detail/CVE-2025-27915","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-09-30","exploitedFirstSeen":"2025-09-30","ransomware":false,"evidence":[{"url":"https://strikeready.com/blog/0day-ics-attack-in-the-wild/","date":"2025-09-30"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-10-07"},{"url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-october-2025-6a3ac29592cb","date":"2025-11-07"},{"url":"https://www.bitsight.com/blog/hidden-dangers-calendar-subscriptions-4-million-devices-risk","date":"2025-11-25"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://www.proofpoint.com/us/blog/threat-insight/ta458-roundpress-exploits","date":"2026-07-23"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes","tags":["Release Notes"]},{"url":"https://strikeready.com/blog/0day-ics-attack-in-the-wild/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915","tags":["US Government Resource"]}],"techniques":[{"id":"T1566","name":"Phishing","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Malicious email content delivered to victim","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"When a user views an e-mail message containing a malicious ICS entry","start":223,"end":291}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Injected JavaScript executes in victim browser","mappingType":"primary_impact","evidence":[{"from":"description","quote":"its embedded JavaScript executes via an ontoggle event inside a <details> tag","start":293,"end":370}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-7823","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7823","exploited":true,"exploitedSince":"2025-10-07","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-27915","name":"Zimbra - Cross-Site Scripting via ICS Files","severity":"medium","path":"http/cves/2025/CVE-2025-27915.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27915.yaml"}],"provenance":"source"},"exploitRefs":["https://strikeready.com/blog/0day-ics-attack-in-the-wild/"],"flow":[{"stage":"exploitation","techniques":["T1566"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2025-03-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27915","provenance":"source"},{"date":"2025-09-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://strikeready.com/blog/0day-ics-attack-in-the-wild/","provenance":"source"},{"date":"2025-10-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-10-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7823","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":209},"priority":{"score":64.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 395 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.13,"detail":"percentile 0.9064"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":3.78,"detail":"base score 5.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-synacor-zimbra-collaboration-suite-zcs-cwe-79"}}