Zimbra CVE-2025-48700 Active Exploitation Detected by Italy CSIRT
Summary
CSIRT-ITA has issued Alert AL06/260422/CSIRT-ITA confirming active in-the-wild exploitation of CVE-2025-48700, a stored Cross-Site Scripting vulnerability in Zimbra Collaboration Suite with CVSS v3.x score of 7.2 (High). The flaw stems from insufficient HTML sanitization in the Classic UI email interface, allowing malicious code hidden in HTML email content to bypass security controls and execute in users' browser sessions, enabling unauthorized access to sensitive system information. Affected versions span ZCS 10.1.x, 10.0.x, 9.x, and 8.8.x branches prior to their respective latest patched releases. CSIRT-ITA recommends immediate patching to the latest available versions as the primary mitigation measure.
About this source
GovPing monitors Italy CSIRT Advisories for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 3 changes logged to date.
What changed
CSIRT-ITA issued a Priority alert confirming active exploitation of CVE-2025-48700, a stored XSS vulnerability in Zimbra Collaboration Suite Classic UI, CVSS v3.x 7.2. The flaw allows malicious HTML in emails to bypass sanitization via techniques such as @import directives, enabling JavaScript execution in victim browsers and unauthorized access to session-based information. Four ZCS version branches are affected: 10.1.x prior to 10.1.4, 10.0.x prior to 10.0.12, 9.x prior to 9.0.0 Patch 43, and 8.8.x prior to 8.8.15 Patch 47.
Organizations running any affected ZCS version should treat this as an urgent patching priority given confirmed active exploitation. System administrators should verify current ZCS patch levels, apply the latest vendor patches without delay, and monitor for signs of suspicious email-based intrusions. Organizations that cannot patch immediately should consider disabling the Classic UI or implementing additional email content filtering at the perimeter.
What to do next
- Update ZCS to the latest available version
Archived snapshot
Apr 23, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Zimbra: rilevato sfruttamento in rete della CVE-2025-48700
**
Alert**
AL06/260422/CSIRT-ITA
Condividi
- Facebook
- Twitter
- LinkedIn
- Whatsapp
Sintesi
Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2025-48700 – già sanata dal vendor – che interessa Zimbra Collaboration Suite (ZCS). Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato l’accesso ad informazioni sensibili sui sistemi interessati.
Tipologia
- Information Disclosure
Descrizione e potenziali impatti
È stato recentemente rilevato lo sfruttamento della vulnerabilità CVE-2025-48700 – di tipo “ Cross-Site Scripting ” e con score CVSS v3.x pari a 7.2 – presente nella Classic UI di Zimbra Collaboration Suite (ZCS).
La vulnerabilità è causata da una sanitizzazione insufficiente del contenuto HTML delle e‑mail visualizzate nell’interfaccia web di ZCS. In particolare, alcune parti del codice HTML delle e‑mail non vengono filtrate correttamente, consentendo l’inserimento di codice malevolo nascosto all’interno di tag e attributi apparentemente legittimi (ad esempio tramite direttive @import). Ciò permette al codice JavaScript malevolo di eludere i controlli di sicurezza ed essere eseguito nel browser, nel contesto della sessione dell’utente vittima. Un attaccante potrebbe sfruttare tale vulnerabilità, tramite invio di e‑mail HTML opportunamente predisposte, e ottenere accesso non autorizzato a informazioni sensibili.
Prodotti e/o versioni affette
Zimbra Collaboration Suite (ZCS)
- 10.1.x, versioni precedenti alla 10.1.4
- 10.0.x, versioni precedenti alla 10.0.12
- 9.x, versioni precedenti alla 9.0.0 Patch 43
- 8.8.x, versioni precedenti alla 8.8.15 Patch 47
Azioni di Mitigazione
Ove non provveduto, si raccomanda di aggiornare i prodotti vulnerabili alle ultime versioni disponibili.
CVE (1)
Cerca:
| CVE | POC | EXPLOITATION |
| --- | --- | --- |
| CVE-2025-48700 | - | Presente |
Riferimenti (2)
Change log
| Versione | Note | Data |
|---|---|---|
| 1.0 | Pubblicato il 22-04-2026 | 22/04/2026 |
Impatto sistemico
Alto (70.64)
Argomenti
Data pubblicazione
22/04/26 ore 16:02
Data Ultimo Aggiornamento
22/04/26 ore 16:02
Parties
Related changes
Get daily alerts for Italy CSIRT Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CSIRT-ITA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Italy CSIRT Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.