CVE-2025-68645
Published 2025-12-22 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2025-68645 is a high-severity (CVSS 8.8) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). CISA added it to the Known Exploited Vulnerabilities catalog on January 22, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 12, 2026. CISA does not currently list it as used in ransomware campaigns. Synacor has 19 vulnerabilities in the KEV catalog, 6 of them linked to ransomware.
All 19 known-exploited Synacor vulnerabilities →Description
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Synacor — Zimbra Collaboration Suite (ZCS)
Name: Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Date added: 2026-01-22 · Due: 2026-02-12
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.