27 September 2026
Reference: CVE-2025-27915
1. What is being reported?
The report describes a vulnerability in Zimbra Collaboration versions 9.0, 10.0, and 10.1 where malicious code hidden inside calendar files (ICS) in emails can run automatically when viewed. This happens because the software does not properly clean the content, allowing attackers to execute harmful scripts within the user’s email session.
2. What this means in plain English
If exploited, an attacker could change your email filters without permission, potentially redirecting your emails to someone else. This could lead to sensitive information being leaked or important messages being missed, which is especially risky for small organisations relying on email for communication.
3. Could this affect a small business?
Small businesses using the affected versions of Zimbra Collaboration software with the Classic Web Client could be vulnerable. Organisations not using Zimbra or using other email systems are unlikely to be affected.
4. What to do now
- Check if your organisation uses Zimbra Collaboration version 9.0, 10.0, or 10.1 with the Classic Web Client.
- Ask your IT provider or software supplier if patches or updates are available to fix this vulnerability.
- Avoid opening unexpected or suspicious calendar files attached to emails until the issue is resolved.
- Ensure your email system has appropriate security measures, such as filtering and monitoring for unusual email rules or redirects.
5. Ask your IT provider
Can you confirm if our Zimbra Collaboration software is affected by CVE-2025-27915, and what steps are being taken to protect our email system from this vulnerability?
6. Bottom line
If you use Zimbra Collaboration, check with your IT support to ensure your email system is protected against this calendar file vulnerability.
Information based on NVD, CISA KEV, and reputable security reporting.