How Attackers Exploited the Zimbra Zero-Day via Calendar Invitations

Our team of experts are dedicated to developing cutting-edge software solutions that provide the ultimate protection for your digital assets

Introduction

In early 2025, a stealthy and sophisticated attack campaign targeted Zimbra Collaboration Suite (ZCS). Threat actors embedded malicious JavaScript inside trusted iCalendar (.ICS) invitations, allowing execution when victims previewed or opened the invite in the Classic Web Client. Because calendar invites are often trusted in enterprise workflows, the payload bypassed common email defenses. This article explains how the exploit worked, who was impacted, and what to do now.

What Was the Vulnerability?

The root issue was a stored cross-site scripting (XSS) vulnerability (CVE-2025-27915) in Zimbra’s Classic Web Client. Improper sanitization of HTML content embedded in .ICS files allowed attacker-supplied JavaScript to execute within the user’s session when an invite was viewed or previewed. Once active, scripts could create mail filters, redirect messages, harvest credentials, query APIs, and exfiltrate data.

Affected versions:

Zimbra Collaboration Kepler prior to 9.0.0 Patch 44
Zimbra Collaboration Daffodil prior to 10.0.13 and 10.1.5

How Did the Attack Work?

Reports describe well-crafted lures and obfuscated payloads delivered via oversized .ICS attachments. Key behaviors observed included delayed execution (e.g., 60 seconds), conditional triggers (e.g., only after three days), UI element hiding to reduce suspicion, credential harvesting, SOAP API queries to enumerate data, mail-forwarding rule creation (e.g., a rule named “Correo” forwarding to external addresses), and exfiltration to attacker-controlled domains.

Spoofed credible senders and organizations.
.ICS attachments larger than typical invites (e.g., > 10 KB) containing embedded script.
Obfuscated JavaScript with execution delays and evasion checks.
Abuse of in-session privileges to read, forward, and exfiltrate data.

Why This Attack Is Especially Concerning

Trusted format: Calendar invites are considered benign, lowering user suspicion and control scrutiny.
Defense bypass: Payload execution happens on preview/open, not via typical executable downloads.
High impact XSS: While not RCE, in-session access enables credential theft, mail rules, and data access.
Targeted operations: Reporting suggests espionage-style targeting of high-value entities.
Widely acknowledged risk: Added to KEV lists urging rapid remediation.

Who Is at Risk?

Any organization running affected Zimbra versions is at risk, with evidence pointing to targeted campaigns against high-value sectors (government, defense, and related). Smaller organizations should still act—techniques often diffuse to broader threat actors after publicity.

How to Defend Your Organization

Patch immediately. Upgrade to Zimbra 9.0.0 Patch 44+, 10.0.13+, or 10.1.5+. Verify with your vendor/hosted provider.
Treat calendar attachments cautiously. Include .ICS in attachment policies, train users to validate unexpected invites, and scrutinize for unusual size or embedded content.
Monitor for indicators. Flag large .ICS files with script-like strings; audit for new/odd forwarding rules; watch for unusual outbound requests from webmail clients.
Layered controls. Sandbox attachments (including invites), segment collaboration systems, and maintain strong logging/alerting around mail activities.
Be incident-ready. Have a response plan: reset credentials, audit access, isolate systems, validate mailbox/filter integrity, and perform forensic review.

Conclusion

The Zimbra .ICS exploit underscores a key lesson: “trusted” formats can be weaponized when input sanitization is insufficient. By patching swiftly, monitoring for unusual behaviors, training users, and layering defenses, organizations can materially reduce exposure to this and similar threats.