cyber.hendryadrian.com

CVE

CVE-2025-27915

First Reported
Jul 15, 2026
Latest Reported
Sep 24, 2026
Articles
2
View articles →
IOC
12
View indicators →

CVE Enrichment

CVSS
5.4 MEDIUM
EPSS
4.06%
EPSS Percentile
90.42%
CISA KEV
YES — Known Exploited Vulnerability

Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

Technical Details

CVSS Version
3.1
CNA / NVD Source
cve@mitre.org
Published
12-Mar-2025 22:15
Last Modified
17-Jun-2026 16:04
EPSS Date
2026-10-10
CWE
CWE-79

CVSS Vector

CVSS:3.1 AV:N / AC:L / PR:L / UI:R / S:C / C:L / I:L / A:N

CISA KEV Details

Date Added
2025-10-07
Remediation Due
2025-10-28
Known Ransomware Campaign Use
Unknown
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://wiki.zimbra.com/wiki/Security_Center ; https://nvd.nist.gov/vuln/detail/CVE-2025-27915

Affected Products / Versions

References

Last enrichment sync: 11-Oct-2026 13:03
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

CVE (11)

CVE-2022-279251 related articleCVE-2022-370421 related articleCVE-2023-375801 related articleCVE-2023-437701 related articleCVE-2024-420091 related articleCVE-2024-429001 related articleCVE-2024-455191 related articleCVE-2025-39291 related articleCVE-2025-491131 related articleCVE-2026-735701 related article

VIEW MORE

Malware (1)

SpyPress1 related article

Threat Actors (3)

APT281 related articleFancy Bear1 related articleTA4581 related article

MITRE ATT&CK (5)

T1059.0041 related articleT1059.0071 related articleT11051 related articleT11901 related articleT1505.0031 related article

Vendors (2)

Alinto1 related articleZimbra1 related article

Products (7)

Classic Web Client1 related articleKerio Webmail1 related articleMDaemon1 related articleRoundcube1 related articleSOGo1 related articleZimbra1 related articleZimbra Collaboration Suite1 related article

Tools (1)

Obfuscator IO1 related article

Industries (5)

Military2 related articlesChemical1 related articleGovernment1 related articleTechnology1 related articleTelecommunications1 related article

Countries (7)

Albania1 related articleBrazil1 related articleGreece1 related articleMoldova1 related articleRussia1 related articleTürkiye1 related articleUkraine1 related article

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.