5x Surge in Zimbra Attacks: Secure Your Collaboration Suite Now
Here’s a snippet of your Monday report on immediate and emerging threats. Powered by the CrowdSec Network. To see the full report, check out the article: https://www.crowdsec.net/vulntracking-report/zimbra-collaboration-coordinated-attack
The CrowdSec Network has detected a notable inflow of signals exploitation attempts targeting Zimbra Collaboration (acquired by Synacor in 2015). This wave is driven by two distinct vulnerabilities: a newly weaponized Local File Inclusion (LFI) flaw (CVE-2025-68645) and a persistent Cross-Site Scripting (XSS) vulnerability (CVE-2022-27926).
Key findings
Exploitation Spike: On January 28, 2026, we observed a massive spike in activity targeting these two vulnerabilities, reaching 5 times the regular levels with over 1,000 distinct IPs detected in a single day.
CVE-2025-68645 (LFI): Published in late December 2025. CrowdSec released a detection rule on January 14, 2026.
Geographic Sources: In the last 7 days, the majority of attacking IPs originated from the United States (975 distinct IPs), followed by Canada (209) and Ireland (201). France, the UK, Germany, and Russia followed with significantly lower volumes.
CVE-2022-27926 (XSS): Despite being from 2022, this vulnerability remains a favorite among attackers, with 58 malicious IPs reported, indicating sustained interest in compromising webmail sessions.
Other Active Threats: We are also detecting ongoing exploitation of CVE-2022-37042 (Authentication Bypass) and CVE-2022-27925 (Remote Code Execution), confirming that attackers are throwing every available exploit at Zimbra instances.
...
