CVE-2025-68645: Zimbra Collaboration file inclusion, actively exploited
The short version: Zimbra Collaboration has a file-inclusion flaw (CVE-2025-68645) in the Webmail Classic UI that lets a remote attacker craft requests to the /h/rest endpoint, influence internal request dispatching, and include arbitrary files from the web root. It's in CISA's KEV catalog and fixes exist. Zimbra is a perennial target — patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — KEV-listed on a heavily targeted platform (see below) |
| CVSS v3.1 (NVD) | 8.8 — High · AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | ~31.8% · 98.1th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-02-12 |
| Known exploited? | Yes — KEV-listed |
| Vulnerability type | CWE-98 file inclusion (LFI/RFI) → arbitrary file inclusion from the web root |
| Requires authenticated session? | No authentication, but the NVD vector notes user interaction (UI:R) |
| Affected | Zimbra Collaboration (ZCS) 10.0.0 before 10.0.18 and 10.1.0 before 10.1.13 |
| Fixed in | 10.0.18 · 10.1.13 (and later) |
What you need to know
CVE-2025-68645 is a file-inclusion flaw in the Webmail Classic UI of Zimbra Collaboration. Because the RestFilter servlet improperly handles user-supplied request parameters, a remote attacker can craft requests to the /h/rest endpoint that influence internal request dispatching and cause the server to include arbitrary files from the web root.
Why this deserves prompt attention:
- The endpoint is reachable without an account — the NVD vector notes user interaction as a factor, but there's no pre-authentication credential requirement.
- File inclusion is a stepping stone. Reaching internal files and dispatch logic can expose configuration and support follow-on attacks.
- Zimbra is a standing target. Mail platforms like ZCS are hammered by attackers, and this one is KEV-listed — an exposed, unpatched server should not sit.
How serious we see it
High — KEV-listed on a platform attackers hit relentlessly.
The 8.8 base reflects strong impact with a user-interaction factor rather than fully unauthenticated, hands-off exploitation. We rate it High and treat it urgently because it's in KEV, Zimbra has a long history of mass exploitation, and file inclusion on a mail server is a meaningful foothold. The bounded, reassuring part is that it's specific and fixed: ZCS 10.0 before 10.0.18 and 10.1 before 10.1.13, with published fixes and quick-to-confirm exposure.
Recommendations
Straight from Zimbra's Security Center and CISA:
- Patch now. Upgrade Zimbra Collaboration to 10.0.18 / 10.1.13 or later.
- Hunt for prior use. Review web logs for anomalous
/h/restrequests and unexpected file access. - If compromised, respond. Rotate credentials and secrets the server could reach, and investigate for follow-on activity.
- Restrict exposure. Limit administrative surfaces and keep unnecessary interfaces off the open internet.
- Confirm your exposure first. Verify whether you run ZCS 10.0/10.1 and which build.
How BreachRisk sees it
BreachRisk discovers internet-facing Zimbra servers from the outside, fingerprints the product and version, and flags exposure tied to this KEV-listed CVE so it rises to the top of your results. Where safe verification is possible, it issues a single bounded, non-destructive request that attempts to include a harmless internal file and checks for its markers — confirming the flaw resolves rather than assuming it from a banner, and never a weaponized exploit. That's the difference between "this looks like a vulnerable Zimbra" and "we confirmed the inclusion works."