Zimbra Zero-Day Exploited to Target Brazilian Military via Malicious ICS Files

🗓️ 06 Oct 2025 06:01:00Reported by The Hacker NewsType

Zimbra CVE-2025-27915 stored XSS via malicious ICS in emails, enabling data exfiltration.

Reporter	Title	Published	Views	Family All 22
Information Security Automation	November “In the Trend of VM” (#21): vulnerabilities in Windows, SharePoint, Redis, XWiki, Zimbra Collaboration, and Linux	14 Nov 202520:44	–	avleonov
Information Security Automation	About Cross Site Scripting – Zimbra Collaboration (CVE-2025-27915) vulnerability	26 Oct 202521:35	–	avleonov
BDU FSTEC	The vulnerability of the Zimbra Collaboration Suite’s email management system, related to the lack of measures taken to protect the website structure, allows attackers to execute cross-site scripting attacks (XSS) and gain access to protected information.	7 Oct 202500:00	–	bdu_fstec
Circl	CVE-2025-27915	18 Mar 202517:52	–	circl
CISA KEV Catalog	Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability	7 Oct 202500:00	–	cisa_kev
CISA	CISA Adds One Known Exploited Vulnerability to Catalog	7 Oct 202512:00	–	cisa
CNNVD	Zimbra Collaboration Server 安全漏洞	12 Mar 202500:00	–	cnnvd
CVE	CVE-2025-27915	12 Mar 202500:00	–	cve
Cvelist	CVE-2025-27915	12 Mar 202500:00	–	cvelist
EUVD	EUVD-2025-7823	3 Oct 202520:07	–	euvd