DaystoPatch

Zimbra (Synacor)Exploited incident

Zimbra Classic Web Client stored XSS via ICS calendar files (CVE-2025-27915)

CVE-2025-27915Medium, CVSS 5.4In CISA's Known Exploited Vulnerabilities catalog since 7 Oct 2025

FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Zimbra blog: Patch for Zimbra Classic Web Client Vulnerability - Stay Secure by UpdatingCuratedQuote verified

    By Administrator on January 27, 2025

    Nothing about the bug was public before Zimbra's patch announcement; StrikeReady's exploitation report came later (2025-09-30).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7d2c0c6b7a726f4f…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2025-27915ClaimedQuote verified12 Mar 2025, 00:00 UTC

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c3f3024742e67f4e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet13 Mar 2025, 15:30 UTC

    CVE Alert: CVE-2025-27915 - https://www. redpacketsecurity.com/cve_aler t_cve-2025-27915/ # OSINT # ThreatIntel # CyberSecurity # cve_2025_27915

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet2 Oct 2025, 17:35 UTC

    193.29.58.37 spoofed the Libyan Navy’s Office of Protocol to send a then-zero-day exploit in Zimbra’s Collaboration Suite, CVE-2025-27915, targeting Brazil’s m...

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-27915)ClaimedQuote verified7 Oct 2025

    Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

    Added to CISA's KEV catalog on 2025-10-07.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Zimbra blog: Patch for Zimbra Classic Web Client Vulnerability - Stay Secure by UpdatingCuratedQuote verified

    This patch fixes a critical security vulnerability related to stored cross-site scripting in the Zimbra Classic Web Client.

    Post dated 2025-01-27 ('By Administrator on January 27, 2025'); it does not mention exploitation.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7d2c0c6b7a726f4f…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.5 was released on Mon Jan 27 2025.

    Zimbra's advisories table maps CVE-2025-27915 to 9.0.0 Patch 44, 10.0.13 and 10.1.5. wiki.zimbra.com was in maintenance on 2026-10-22, so a Wayback capture is cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 9.0.0 Patch 44 was released on Mon Jan 27 2025.

    10.1.5, 10.0.13 and 9.0.0 Patch 44 were all released the same day; 8.8.15 is not listed as affected.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Zimbra Collaboration Suite 9.0 before Patch 44, 10.0 before 10.0.13, 10.1 before 10.1.5 (Classic Web Client)
How we built this timeline

exploited before a fix is null because the claim is disputed. StrikeReady Labs (30 Sep 2025) wrote that 'Earlier in 2025, an apparent sender from 193.29.58.37 spoofed the Libyan Navy's Office of Protocol to send a then-zero-day exploit in Zimbra's Collaboration Suite, CVE-2025-27915, targeting Brazil's military', without giving a date.

Zimbra told The Hacker News (6 Oct 2025 update) that its investigation found no evidence of the flaw being exploited in attacks targeting Brazilian entities. CISA added it to KEV on 7 Oct 2025.

StrikeReady's live page now returns 404, so its Wayback capture is the record. CVSS 5.4 is the CISA-ADP score in the CVE record (published 12 Mar 2025).

Related

No related incidents.

Zimbra (Synacor) report card