Digest · Thursday

Security digest: November 6, 2025

1 editorial brief.

All digests · RSS · Markdown

Take stock

Check exposure: Zimbra CVE-2025-68645: Exploited /h/rest File Inclusion. Administrators of self-hosted Zimbra 10.1 before 10.1.13 or any 10.0 release, especially internet-facing webmail, plus anyone still running the end-of-life 9.0 or 8.8.15 lines.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

Nov 6, 2025 · Vulnerability · CVE-2025-68645

Zimbra CVE-2025-68645: Exploited /h/rest File Inclusion

If any Zimbra server is below 10.1.13 or still on 10.0, patch or migrate now and check its logs for /h/rest probes; servers on a current 10.1 patch only need to stay current.

Must act: Administrators of self-hosted Zimbra 10.1 before 10.1.13 or any 10.0 release, especially internet-facing webmail, plus anyone still running the end-of-life 9.0 or 8.8.15 lines.

Can relax: Zimbra servers on 10.1.13 or later that are kept on the current patch, and organizations that do not run self-hosted Zimbra.

Check every mailbox node with su - zimbra -c 'zmcontrol -v'.
Upgrade to the current Zimbra 10.1 patch; 10.1.13 is the minimum for this CVE.
Migrate any 10.0, 9.0 or 8.8.15 server to 10.1, since those lines get no further fixes.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.