PT-2025-26606 · Zimbra · Zimbra Collaboration

Published 2025-06-23 · Updated 2026-05-19 · CVE-2025-48700

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) version 8.8.15 Zimbra Collaboration (ZCS) version 9.0 Zimbra Collaboration (ZCS) version 10.0 Zimbra Collaboration (ZCS) version 10.1

Description A Cross-Site Scripting (XSS) issue exists in the Zimbra Classic UI due to insufficient sanitization of HTML content. This allows attackers to execute arbitrary JavaScript within a user's session by using crafted tag structures and attribute values containing an @import directive and other script injection vectors. The issue is triggered when a user views a specially crafted email message, requiring no additional user interaction, and can lead to unauthorized access to sensitive information or full email account takeover. Over 10,500 servers worldwide have been identified as unpatched, and the issue is being actively exploited in the wild, with some incidents involving network-wide pivoting after the initial compromise.

Recommendations Update Zimbra Collaboration (ZCS) version 8.8.15 to the June 2025 patched version. Update Zimbra Collaboration (ZCS) version 9.0 to the June 2025 patched version. Update Zimbra Collaboration (ZCS) version 10.0 to the June 2025 patched version. Update Zimbra Collaboration (ZCS) version 10.1 to the June 2025 patched version.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-12729

CVE-2025-48700

Affected Products

Zimbra Collaboration

References · 25

• https://nvd.nist.gov/vuln/detail/CVE-2025-48700 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48700 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12729 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48700 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://twitter.com/ctiwatchcloud/status/2046438821101818078 · Twitter Post
• https://twitter.com/Shadowserver/status/2047611947793670164 · Twitter Post
• https://wiki.zimbra.com/wiki/Security_Center · Note
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory, Security Note
• https://twitter.com/ScyScan/status/2046395022569083153 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://twitter.com/VulmonFeeds/status/1937189128489062468 · Twitter Post
• https://twitter.com/__kokumoto/status/2046362934901928271 · Twitter Post
• https://t.me/CSIRT_italia/3430 · Telegram Post
• https://t.me/cvetracker/26840 · Telegram Post