CVE-2025-27915: Zimbra Classic Web Client stored XSS via ICS file HTML

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is confirmed exploited in the wild and in CISA KEV, but requires user interaction and low privileges, and the CVSS base score is only 5.4.

What it is

Zimbra Collaboration Suite 9.0, 10.0 and 10.1 fail to sanitize HTML content in ICS files in the Classic Web Client. A malicious ICS entry embedded in an email executes JavaScript through an ontoggle event in a <details> tag when the message is viewed. Because the script runs in the victim's session, it can drive account actions such as creating mail filters that redirect messages to an attacker-controlled address.

Impact

An attacker gains arbitrary JavaScript execution in the victim's authenticated Zimbra session, enabling unauthorized account changes and exfiltration of email content via redirection filters. The CVSS scope change (S:C) reflects that the impact can extend beyond the vulnerable component.

Attack surface

Reached remotely over the network by sending an email containing a crafted ICS entry that the victim opens in the Classic Web Client. The vector requires low privileges (PR:L) and user interaction (UI:R) for the victim to view the message; no other authentication bypass is described.

Exploitation

CVE-2025-27915 is listed in CISA KEV with a due date of 2025-10-28, and a third-party reference is tagged Exploit, indicating exploitation in the wild. EPSS 30-day probability is 0.03986 (89.98th percentile), so mass scanning is plausible though not dominant.

What to do

• Apply the vendor security fixes referenced for Zimbra 9.0.0 P44, 10.0.13 and 10.1.5, or upgrade to a supported release containing them.
• If patching is not immediately possible, follow CISA KEV required action and vendor instructions, including BOD 22-01 guidance for cloud services or discontinuing use where mitigations are unavailable.
• Restrict or disable the Classic Web Client where feasible and steer users to the Modern Web Client until patched.
• Filter or strip ICS attachments and embedded HTML at the mail gateway, and block external content in email where policy allows.
• Review existing mail filters and forwarding rules for unauthorized redirection to external addresses.

Detection

• Hunt for newly created or modified Zimbra mail filters that forward or redirect messages to external domains.
• Search mail logs and message stores for ICS attachments containing <details> tags or ontoggle event handlers.
• Monitor for anomalous authenticated web sessions performing filter changes shortly after message views.
• Alert on outbound email volume spikes to addresses not previously seen in the environment.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.