Zimbra Zero-Day Exploited to Target Brazilian Military via Malicious ICS Files
Earlier this year, cyberattacks against the Brazilian military used a zero-day exploit of a now-patched security flaw in Zimbra Collaboration.
A stored cross-site scripting (XSS) vulnerability in the Classic Web Client, identified as CVE-2025-27915 (CVSS score: 5.4), occurs when HTML content in ICS calendar files is not sufficiently sanitized, leading to arbitrary code execution.
A description of the vulnerability in the NIST National Vulnerability Database (NVD) states that when a user opens an email message with a malicious ICS entry, the embedded JavaScript runs via an ontoggle event inside a element.
This gives the attacker the ability to execute any JavaScript code inside the victim's session, which could result in illegal activities like using email filters to reroute commu...