NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Zimbra Classic webmail flaw CVE-2025-48700 used in attacks; fixes available for all affected branches

Attackers are exploiting CVE-2025-48700 in Zimbra’s Classic webmail interface to access sensitive information. Viewing a malicious email can trigger it. Ask your email provider or IT team to confirm its Zimbra server runs a supported, patched release.

What to do

If your work or hosted email uses Zimbra, ask its IT team or provider to confirm the server runs a current supported release containing the fix. The first fixed versions were 8.8.15 Patch 47, 9.0.0 Patch 43, 10.0.12 and 10.1.4; updating your browser does not update the email server.

What’s happening

CVE-2025-48700 affects the Classic webmail interface in Zimbra Collaboration, the email and collaboration server used by organisations and hosting providers. A malicious email can run JavaScript within the reader’s signed-in session when viewed, potentially exposing sensitive information without another click. Zimbra lists fixes in 8.8.15 Patch 47, 9.0.0 Patch 43, 10.0.12 and 10.1.4. Its release history dates those versions to 17 December 2024; BleepingComputer instead described the fixes as released in June 2025. Ukraine’s SSSCIP reported campaigns exploiting this and another Zimbra flaw, with successful compromises exposing mail and account secrets. CISA listed this flaw as exploited on 20 April 2026. Four days later, BleepingComputer reported more than 10,500 exposed, unpatched servers, citing Shadowserver. As at 3 November, fixes are available across all four affected branches; the reviewed sources establish neither a total victim count nor that attacks have ended.

What
Flaw
Affects
Zimbra Collaboration Suite (ZCS), Classic webmail interface
Affected
Zimbra Collaboration 8.8.15 before Patch 47
Zimbra Collaboration 9.0.0 before Patch 43
Zimbra Collaboration 10.0 before 10.0.12
Zimbra Collaboration 10.1 before 10.1.4
Fixed in
Zimbra Collaboration 8.8.15 Patch 47
Zimbra Collaboration 9.0.0 Patch 43
Zimbra Collaboration 10.0.12
Zimbra Collaboration 10.1.4
CVE
CVE-2025-48700
Since
20 Apr 2026
Closed
24 Apr 2026

Timeline

  1. Update

    BleepingComputer reported Shadowserver’s finding that more than 10,500 internet-facing Zimbra servers remained unpatched. This was an exposure count, not a count of confirmed victims.

  2. CISA added

    CISA added CVE-2025-48700 to its Known Exploited Vulnerabilities catalogue. US federal civilian agencies were given until 23 April to secure affected systems.

  3. Made public

    Ukraine’s SSSCIP reported that UAC-0250 campaigns observed since late September 2025 exploited this and another Zimbra flaw. Successful compromises exposed mailbox contents, multi-factor authentication backup codes, application passwords and address books.

  4. New fixFixed

    Zimbra released 8.8.15 Patch 47, 9.0.0 Patch 43, 10.0.12 and 10.1.4. Its security advisory identifies these versions as fixing CVE-2025-48700.

Sources

  1. Zimbra Security AdvisoriesZimbra
  2. Security CenterZimbra
  3. Zimbra Daffodil (v10.1.4) Patch ReleaseZimbra · 17 Dec 2024
  4. Cyber Threats: Ukraine. Analytics for the H2 2025SSSCIP · 1 Apr 2026
  5. Analytical Materials of the SSSCIPSSSCIP · 1 Apr 2026
  6. Zimbra Collaboration Suite Information Disclosure VulnerabilityHKCERT · 21 Apr 2026
  7. Over 10,000 Zimbra servers vulnerable to ongoing XSS attacksBleepingComputer · 24 Apr 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS