{"id":"zimbra-classic-webmail-xss-apr-2026","category":"patch","status":"closed","title":"Zimbra Classic webmail flaw CVE-2025-48700 used in attacks; fixes available for all affected branches","tldr":"Attackers are exploiting CVE-2025-48700 in Zimbra’s Classic webmail interface to access sensitive information. Viewing a malicious email can trigger it. Ask your email provider or IT team to confirm its Zimbra server runs a supported, patched release.","summary":"CVE-2025-48700 affects the Classic webmail interface in Zimbra Collaboration, the email and collaboration server used by organisations and hosting providers. A malicious email can run JavaScript within the reader’s signed-in session when viewed, potentially exposing sensitive information without another click. Zimbra lists fixes in 8.8.15 Patch 47, 9.0.0 Patch 43, 10.0.12 and 10.1.4. Its release history dates those versions to 17 December 2024; BleepingComputer instead described the fixes as released in June 2025. Ukraine’s SSSCIP reported campaigns exploiting this and another Zimbra flaw, with successful compromises exposing mail and account secrets. CISA listed this flaw as exploited on 20 April 2026. Four days later, BleepingComputer reported more than 10,500 exposed, unpatched servers, citing Shadowserver. As at 3 November, fixes are available across all four affected branches; the reviewed sources establish neither a total victim count nor that attacks have ended.","action":"If your work or hosted email uses Zimbra, ask its IT team or provider to confirm the server runs a current supported release containing the fix. The first fixed versions were 8.8.15 Patch 47, 9.0.0 Patch 43, 10.0.12 and 10.1.4; updating your browser does not update the email server.","product":"Zimbra Collaboration Suite (ZCS), Classic webmail interface","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-48700"],"tags":["synacor","zimbra","webmail","xss","exploited"],"affected":["Zimbra Collaboration 8.8.15 before Patch 47","Zimbra Collaboration 9.0.0 before Patch 43","Zimbra Collaboration 10.0 before 10.0.12","Zimbra Collaboration 10.1 before 10.1.4"],"fixed":["Zimbra Collaboration 8.8.15 Patch 47","Zimbra Collaboration 9.0.0 Patch 43","Zimbra Collaboration 10.0.12","Zimbra Collaboration 10.1.4"],"matches":[],"sources":[{"kind":"advisory","title":"Zimbra Security Advisories","url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","by":"Zimbra","date":""},{"kind":"advisory","title":"Security Center","url":"https://wiki.zimbra.com/wiki/Security_Center","by":"Zimbra","date":""},{"kind":"advisory","title":"Zimbra Daffodil (v10.1.4) Patch Release","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4","by":"Zimbra","date":"2024-12-17"},{"kind":"research","title":"Cyber Threats: Ukraine. Analytics for the H2 2025","url":"https://cip.gov.ua/services/cm/api/attachment/download?id=74646","by":"SSSCIP","date":"2026-04-01"},{"kind":"post","title":"Analytical Materials of the SSSCIP","url":"https://cip.gov.ua/en/statics/analitichni-materiali-derzhspeczv-yazku","by":"SSSCIP","date":"2026-04-01"},{"kind":"advisory","title":"Zimbra Collaboration Suite Information Disclosure Vulnerability","url":"https://www.hkcert.org/security-bulletin/zimbra-collaboration-suite-cross-site-scripting-vulnerability_20260421","by":"HKCERT","date":"2026-04-21"},{"kind":"news","title":"Over 10,000 Zimbra servers vulnerable to ongoing XSS attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-says-zimbra-flaw-now-exploited-over-10k-servers-vulnerable/","by":"BleepingComputer","date":"2026-04-24"}],"started":"2026-04-20","closed":"2026-04-24","created":"2026-11-03T22:23:47.527Z","updated":"2026-11-03T22:23:47.527Z","cve_notes":[{"cve":"CVE-2025-48700","name":"Cross-site scripting in Zimbra Classic webmail","what":"Insufficient filtering of email HTML in Zimbra’s Classic webmail interface lets a malicious message run JavaScript in the reader’s signed-in session, potentially exposing sensitive information.","severity":"unknown","cvss":0}],"timeline":[{"at":"2026-04-24","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"BleepingComputer reported Shadowserver’s finding that more than 10,500 internet-facing Zimbra servers remained unpatched. This was an exposure count, not a count of confirmed victims.","url":"https://www.bleepingcomputer.com/news/security/cisa-says-zimbra-flaw-now-exploited-over-10k-servers-vulnerable/","by":"BleepingComputer","patch":null},{"at":"2026-04-20","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2025-48700 to its Known Exploited Vulnerabilities catalogue. US federal civilian agencies were given until 23 April to secure affected systems.","url":"https://www.bleepingcomputer.com/news/security/cisa-says-zimbra-flaw-now-exploited-over-10k-servers-vulnerable/","by":"BleepingComputer","patch":null},{"at":"2026-04-01","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Ukraine’s SSSCIP reported that UAC-0250 campaigns observed since late September 2025 exploited this and another Zimbra flaw. Successful compromises exposed mailbox contents, multi-factor authentication backup codes, application passwords and address books.","url":"https://cip.gov.ua/services/cm/api/attachment/download?id=74646","by":"SSSCIP","patch":null},{"at":"2024-12-17","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Zimbra released 8.8.15 Patch 47, 9.0.0 Patch 43, 10.0.12 and 10.1.4. Its security advisory identifies these versions as fixing CVE-2025-48700.","url":"https://wiki.zimbra.com/wiki/Security_Center","by":"Zimbra","patch":"patched"}],"url":"https://hard.fyi/live/zimbra-classic-webmail-xss-apr-2026/","json":"https://hard.fyi/api/live?id=zimbra-classic-webmail-xss-apr-2026"}