CVE-2025-68645

Product

Synacor / Zimbra Collaboration Suite (ZCS)

Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

Added to KEV

Jan 22, 2026

Remediate by

Feb 12, 2026

Known ransomware use

No

Summary description

Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://wiki.zimbra.com/wiki/Security_Center ; https://nvd.nist.gov/vuln/detail/CVE-2025-68645