A zero-day vulnerability in the Zimbra Collaboration Suite (ZCS), identified as CVE-2025-27915, has been exploited in targeted attacks using weaponized iCalendar files. This stored cross-site scripting (XSS) flaw allows attackers to steal sensitive data from victims' email accounts.

A zero-day vulnerability in Zimbra Collaboration Suite (ZCS) has been exploited by hackers using malicious iCalendar files. The flaw, identified as CVE-2025-27915, allows attackers to execute arbitrary JavaScript and steal sensitive data from Zimbra Webmail.

Oracle has issued a critical patch for a zero-day vulnerability in its E-Business Suite, tracked as CVE-2025-61882, which allows unauthenticated remote code execution. The flaw has been actively exploited in data theft attacks by the Clop ransomware gang.