CISA confirmed this vulnerability is used in real attacks on 22.01.2026. Remediation deadline for US federal agencies: 12.02.2026.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://wiki.zimbra.com/wiki/Security_Center ; https://nvd.nist.gov/vuln/detail/CVE-2025-68645
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| synacor | zimbra collaboration suite | 10.0.0 – < 10.0.18 |
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* ≥ 10.0.0 < 10.0.18cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* ≥ 10.1.0 < 10.1.13Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.