NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Zimbra Collaboration file inclusion flaw CVE-2025-68645 exploited; fixes available

Attackers exploited a Zimbra mail-server flaw that exposes files without a login. Fixes arrived in November 2025. Ask your email provider or IT team to confirm it runs a patched, supported Zimbra 10.1 release; 10.0 is out of support.

What to do

If your family or business uses Zimbra email, ask the provider or IT team to confirm the server runs a current supported 10.1 release; 10.1.13 was the first fix on that branch. Zimbra 10.0.18 also fixes this flaw, but 10.0 is out of support and should be migrated to 10.1.

What’s happening

CVE-2025-68645 affects the Classic webmail interface of Zimbra Collaboration Suite 10.0 and 10.1. It lets a remote attacker access files within the server’s web application directory without logging in. Zimbra calls this local file inclusion; CISA lists it under PHP remote file inclusion. Zimbra released fixes in 10.0.18 and 10.1.13 on 6 November 2025, before the CVE description was published on 22 December. CrowdSec reported exploitation attempts from 14 January 2026, and CISA confirmed exploitation by adding the flaw to its catalogue on 22 January. This concerns organisations and email providers running Zimbra servers; their customers depend on the operator applying updates. Both affected branches received fixes, but 10.0 reached end of life on 31 December 2025. As of 3 November 2026, the reviewed sources do not establish victim numbers, ransomware involvement or an end to exploitation.

What
Flaw
Affects
Zimbra Collaboration Suite email server (Classic webmail interface)
Affected
Zimbra Collaboration Suite 10.0 Classic webmail interface before 10.0.18
Zimbra Collaboration Suite 10.1 Classic webmail interface before 10.1.13
Fixed in
Zimbra Collaboration Suite 10.0.18
Zimbra Collaboration Suite 10.1.13
CVE
CVE-2025-68645
Since
22 Jan 2026
Closed
22 Jan 2026

Timeline

  1. CISA added

    CISA added CVE-2025-68645 to its known-exploited catalogue, with a 12 February remediation deadline for covered US federal agencies. CISA did not disclose attack details; ransomware use was marked unknown.

  2. Wider attacks

    According to CrowdSec, as reported by The Hacker News, exploitation attempts targeting CVE-2025-68645 were observed from this date.

  3. Update

    Zimbra 10.0 reached its announced end-of-life date. Zimbra advised customers to migrate to the supported 10.1 branch for continued security updates.

  4. Made public

    The CVE description was published, identifying the flaw in the Classic webmail interface of Zimbra Collaboration 10.0 and 10.1.

  5. New fixFixed

    Zimbra released ZCS 10.0.18 and 10.1.13, fixing an unauthenticated local file inclusion flaw in RestFilter, subsequently identified as CVE-2025-68645.

Sources

  1. Zimbra Security CenterZimbra · 6 Nov 2025
  2. Zimbra Daffodil 10.0.18 Patch ReleaseZimbra · 6 Nov 2025
  3. Zimbra Daffodil 10.1.13 Patch ReleaseZimbra · 6 Nov 2025
  4. CISA confirms active exploitation of four enterprise software bugsBleepingComputer · 23 Jan 2026
  5. CISA Updates KEV Catalog with Four Actively Exploited Software VulnerabilitiesThe Hacker News · 23 Jan 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from January 2026 · JSON · RSS