Actively exploited · Published Dec 22, 2025 · Assigned by mitre
CVE-2025-68645
High 8.8 Exploited
In plain English
A high-severity security flaw in Zimbra Collaboration Suite (ZCS) from Synacor. Attackers are actively exploiting it in the wild (listed by CISA on January 22, 2026). The chance it is exploited in the next 30 days is estimated at 48.9% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Feb 12, 2026.
Official description
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
Affected products (as reported)
Weakness: CWE-98 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H