CISA Warns Federal Agencies of Actively Exploited Zimbra Email Vulnerability

CISA urges agencies to patch critical Zimbra flaw CVE-2025-68645, exploited by attackers, to prevent unauthorized access and data exposure.

By Content Team

Jan 25, 2026

ON THIS PAGE

CISA added a critical Zimbra Collaboration Suite vulnerability to its Known Exploited Vulnerabilities catalog Thursday, urging federal agencies to patch immediately. The flaw (CVE-2025-68645) allows attackers to access sensitive files without authentication by exploiting the webmail interface's RestFilter servlet.

Threat actors are already using this vulnerability in sophisticated, targeted campaigns according to CrowdSec researchers. The bug can expose internal system information and enable further attacks when combined with other weaknesses.

Zimbra released patches in November 2025 for versions 10.1.13 and 10.0.18. Federal agencies have three weeks to fix this and three other newly identified exploited vulnerabilities under government security directives.

Source: Security Week

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?