CVE-2025-68645: 
Zimbra Collaboration Server vulnerability analysis and mitigation

CVE-2025-68645 is a Local File Inclusion (LFI) / PHP Remote File Inclusion vulnerability in the Webmail Classic UI of Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. The flaw exists in the RestFilter servlet due to improper handling of user-supplied request parameters, allowing unauthenticated remote attackers to craft requests to the /h/rest endpoint and include arbitrary files from the WebRoot directory. Affected versions are ZCS 10.0.0 through 10.0.17 and 10.1.0 through 10.1.12; fixed versions are 10.0.18 and 10.1.13. The vulnerability was published on December 22, 2025, and added to the CISA KEV catalog on January 22, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (CISA KEV, Zimbra Security Center).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program — 'PHP Remote File Inclusion'), with a secondary path traversal characteristic (CWE-22). The RestFilter servlet in Zimbra's Webmail Classic UI fails to properly sanitize user-supplied parameters, allowing an attacker to manipulate internal request dispatching logic via crafted HTTP requests to the /h/rest endpoint. This enables inclusion of arbitrary files accessible within the WebRoot directory without any authentication. Multiple public proof-of-concept repositories have been published, including chinaxploiter/CVE-2025-68645-PoC, MaxMnMl/zimbramail-CVE-2025-68645-poc, Ashwesker/Blackash-CVE-2025-68645, and 0xBlackash/CVE-2025-68645 on GitHub, and detection templates have been added to the ProjectDiscovery Nuclei templates repository (Zimbra Security Center, CISA KEV).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the Zimbra WebRoot directory, potentially exposing sensitive credentials, configuration files, session tokens, and user account data. This information disclosure can enable further compromise of user accounts, privilege escalation, and lateral movement within the affected organization's infrastructure. The vulnerability affects confidentiality, integrity, and availability at a high level, and active exploitation has been confirmed in the wild with the vulnerability linked to potential ransomware campaign use (CISA KEV, BleepingComputer).

CVE-2025-68645 is actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on January 22, 2026, with a remediation due date of February 12, 2026 for federal agencies (CISA KEV). Multiple public proof-of-concept exploits are available on GitHub, and Nuclei detection templates have been published by ProjectDiscovery. The EPSS score is approximately 0.08%, though the confirmed in-the-wild exploitation and KEV listing indicate significant real-world risk. FortiGuard has issued an outbreak alert for this vulnerability, and CrowdSec has reported coordinated attack activity targeting Zimbra instances, with a reported 5x surge in Zimbra attacks following disclosure (FortiGuard Outbreak, BleepingComputer).

1. Reconnaissance: Identify internet-facing Zimbra Collaboration instances running ZCS 10.0.x (before 10.0.18) or 10.1.x (before 10.1.13) using tools like Shodan, Censys, or Nuclei templates targeting the /h/rest endpoint.
2. Identify the vulnerable endpoint: Confirm the target is running the Webmail Classic UI with the RestFilter servlet accessible at /h/rest.
3. Craft malicious request: Send a specially crafted HTTP GET or POST request to the /h/rest endpoint with manipulated user-supplied parameters designed to influence internal request dispatching in the RestFilter servlet.
4. Trigger file inclusion: The manipulated parameters cause the servlet to include an arbitrary file from the WebRoot directory (e.g., configuration files, PHP files containing credentials, or other sensitive data).
5. Exfiltrate sensitive data: Read the response to extract credentials, session tokens, configuration details, or other sensitive information that can be used for further access or lateral movement within the target environment (CISA KEV, Zimbra Security Center).

• Network: Unusual or repeated HTTP requests to the /h/rest endpoint from external or unexpected IP addresses; requests with anomalous or encoded parameter values targeting the RestFilter servlet; outbound connections from the Zimbra server to unknown external hosts following exploitation.
• Logs: Zimbra access logs (/opt/zimbra/log/) showing high volumes of requests to /h/rest with unexpected parameter patterns; error log entries related to file inclusion or path traversal attempts; authentication log anomalies following successful exploitation.
• File System: Unexpected files written to the Zimbra WebRoot or temporary directories; new or modified configuration files; web shells or backdoors placed in accessible web directories.
• Process: Unusual child processes spawned by the Zimbra Java process (e.g., curl, wget, bash, python); unexpected outbound network connections initiated by Zimbra service accounts.

Zimbra has released patched versions addressing this vulnerability: upgrade to ZCS 10.0.18 or later for 10.0.x deployments, and to ZCS 10.1.13 or later for 10.1.x deployments. CISA's BOD 22-01 requires federal agencies to apply mitigations by February 12, 2026; organizations unable to patch immediately should consider restricting access to the /h/rest endpoint at the network perimeter or web application firewall level. Cloudflare WAF and Citrix NetScaler WAF have both released signatures to detect and block exploitation attempts. Upgrading to a patched version is the only definitive remediation (Zimbra Security Center, CISA KEV).

CISA formally added CVE-2025-68645 to its KEV catalog on January 22, 2026, confirming active exploitation and issuing a public alert (CISA Alert). BleepingComputer, The Hacker News, Security Affairs, and SC World covered the KEV addition extensively, highlighting the risk to enterprise Zimbra deployments (BleepingComputer, The Hacker News). FortiGuard issued a dedicated outbreak alert and CrowdSec published a coordinated attack report noting a 5x surge in Zimbra-targeted attacks. The security community on Mastodon, Bluesky, and Reddit flagged the vulnerability as urgent, and Qualys, Tenable, and Check Point all released detection content shortly after disclosure.