{"id":"zimbra-file-inclusion-attacks-jan-2026","category":"patch","status":"closed","title":"Zimbra Collaboration file inclusion flaw CVE-2025-68645 exploited; fixes available","tldr":"Attackers exploited a Zimbra mail-server flaw that exposes files without a login. Fixes arrived in November 2025. Ask your email provider or IT team to confirm it runs a patched, supported Zimbra 10.1 release; 10.0 is out of support.","summary":"CVE-2025-68645 affects the Classic webmail interface of Zimbra Collaboration Suite 10.0 and 10.1. It lets a remote attacker access files within the server’s web application directory without logging in. Zimbra calls this local file inclusion; CISA lists it under PHP remote file inclusion. Zimbra released fixes in 10.0.18 and 10.1.13 on 6 November 2025, before the CVE description was published on 22 December. CrowdSec reported exploitation attempts from 14 January 2026, and CISA confirmed exploitation by adding the flaw to its catalogue on 22 January. This concerns organisations and email providers running Zimbra servers; their customers depend on the operator applying updates. Both affected branches received fixes, but 10.0 reached end of life on 31 December 2025. As of 3 November 2026, the reviewed sources do not establish victim numbers, ransomware involvement or an end to exploitation.","action":"If your family or business uses Zimbra email, ask the provider or IT team to confirm the server runs a current supported 10.1 release; 10.1.13 was the first fix on that branch. Zimbra 10.0.18 also fixes this flaw, but 10.0 is out of support and should be migrated to 10.1.","product":"Zimbra Collaboration Suite email server (Classic webmail interface)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-68645"],"tags":["synacor","zimbra","email","file-inclusion","actively-exploited"],"affected":["Zimbra Collaboration Suite 10.0 Classic webmail interface before 10.0.18","Zimbra Collaboration Suite 10.1 Classic webmail interface before 10.1.13"],"fixed":["Zimbra Collaboration Suite 10.0.18","Zimbra Collaboration Suite 10.1.13"],"matches":[],"sources":[{"kind":"advisory","title":"Zimbra Security Center","url":"https://wiki.zimbra.com/wiki/Security_Center","by":"Zimbra","date":"2025-11-06"},{"kind":"advisory","title":"Zimbra Daffodil 10.0.18 Patch Release","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18","by":"Zimbra","date":"2025-11-06"},{"kind":"advisory","title":"Zimbra Daffodil 10.1.13 Patch Release","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13","by":"Zimbra","date":"2025-11-06"},{"kind":"news","title":"CISA confirms active exploitation of four enterprise software bugs","url":"https://www.bleepingcomputer.com/news/security/cisa-confirms-active-exploitation-of-four-enterprise-software-bugs/","by":"BleepingComputer","date":"2026-01-23"},{"kind":"news","title":"CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities","url":"https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html","by":"The Hacker News","date":"2026-01-23"}],"started":"2026-01-22","closed":"2026-01-22","created":"2026-11-03T22:30:42.688Z","updated":"2026-11-03T22:30:42.688Z","cve_notes":[{"cve":"CVE-2025-68645","name":"Unauthenticated file inclusion in Zimbra Classic webmail","what":"A file inclusion flaw in Zimbra Classic webmail’s RestFilter lets remote attackers access files within the server’s web application directory without logging in.","severity":"unknown","cvss":8.8}],"timeline":[{"at":"2026-01-22","added":"2026-11-03T22:22:59.664Z","kind":"cisa-added","text":"CISA added CVE-2025-68645 to its known-exploited catalogue, with a 12 February remediation deadline for covered US federal agencies. CISA did not disclose attack details; ransomware use was marked unknown.","url":"https://www.bleepingcomputer.com/news/security/cisa-confirms-active-exploitation-of-four-enterprise-software-bugs/","by":"BleepingComputer","patch":null},{"at":"2026-01-14","added":"2026-11-03T22:22:59.664Z","kind":"wider-attacks","text":"According to CrowdSec, as reported by The Hacker News, exploitation attempts targeting CVE-2025-68645 were observed from this date.","url":"https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html","by":"The Hacker News","patch":null},{"at":"2025-12-31","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"Zimbra 10.0 reached its announced end-of-life date. Zimbra advised customers to migrate to the supported 10.1 branch for continued security updates.","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18","by":"Zimbra","patch":null},{"at":"2025-12-22","added":"2026-11-03T22:22:59.664Z","kind":"disclosed","text":"The CVE description was published, identifying the flaw in the Classic webmail interface of Zimbra Collaboration 10.0 and 10.1.","url":"https://www.bleepingcomputer.com/news/security/cisa-confirms-active-exploitation-of-four-enterprise-software-bugs/","by":"BleepingComputer","patch":null},{"at":"2025-11-06","added":"2026-11-03T22:22:59.664Z","kind":"new-fix","text":"Zimbra released ZCS 10.0.18 and 10.1.13, fixing an unauthenticated local file inclusion flaw in RestFilter, subsequently identified as CVE-2025-68645.","url":"https://wiki.zimbra.com/wiki/Security_Center","by":"Zimbra","patch":"patched"}],"url":"https://hard.fyi/live/zimbra-file-inclusion-attacks-jan-2026/","json":"https://hard.fyi/api/live?id=zimbra-file-inclusion-attacks-jan-2026"}