CVE-2025-68645 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-12-22

Added to CISA KEV: 2026-01-22 31 DAYS BETWEEN CVE AND KEV

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
IMMEDIATE: Update Zimbra Collaboration to patched versions as soon as available from Zimbra
Monitor web server logs for suspicious requests to /h/rest endpoint with unusual parameters
Implement web application firewall rules to filter malicious requests to RestFilter servlet
Review file system permissions in WebRoot directory to limit LFI impact
Consider temporarily restricting access to affected endpoints if patching cannot be immediately applied

NVD - CVE-2025-68645
CVE-2025-68645 Detail. Description. A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet.CVSS information contributed by other sources is also displayed. CVSS 4.0 Severity and Vector Strings: NIST CVSS score.
CVE-2025-68645 Security Vulnerability & Exploit Details
CVE-2025-68645 Vulnerability Analysis & Exploit Details.Attack Complexity (AC) measures the difficulty in executing an exploit. A high AC means that specific conditions must be met, making an attack more challenging, while a low AC means the vulnerability can be exploited with minimal effort. Privileges Required (PR) determine the level of system access necessary for an attack.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE ...
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

🔴 CVE-2025-68645