Zimbra CVE-2023-34192: 2023 XSS Added to KEV in 2025

What to do

1. Check the version on every Zimbra node with su - zimbra -c 'zmcontrol -v'.
2. If any node is below 8.8.15 Patch 40, patch it now as a stopgap.
3. Plan and run the migration off 8.8.15 to a current Zimbra 10.1 patch.
4. Until migrated, keep webmail behind a VPN or allowlist and require strong passwords or 2FA.
5. Review accounts for forwarding rules and filters that users did not set.

How to check if you are affected or compromised

• Search accounts for unexpected forwarding addresses with zmprov sa '(zimbraPrefMailForwardingAddress=*)'.
• Review /opt/zimbra/log/audit.log for logins from unfamiliar addresses.
• Grep /opt/zimbra/log/access_log.* for requests to /h/autoSaveDraft carrying script tags or event handlers.

What happened#

Zimbra fixed CVE-2023-34192 in Zimbra Collaboration 8.8.15 Patch 40, released May 30, 2023. The release notes list it as "a possible Cross-site Scripting (XSS) security vulnerability" rated High. The CVE record, published July 6, 2023, says it lets "a remote authenticated attacker" execute arbitrary code via a crafted script to the /h/autoSaveDraft function, the draft autosave in the classic HTML client. Zimbra's advisory table credits Skay of Noah-Lab. NVD scores it CVSS 3.1 9.0. In practice, "arbitrary code" means script running in a victim's webmail session, with access to their mail and settings.

On February 25, 2025, almost two years after the patch, CISA added it to the KEV catalog with a March 18 deadline. The alert cites "evidence of active exploitation" and pairs it with a Microsoft Partner Center flaw.

Why it reached KEV in 2025: no public reason is documented. CISA did not describe the activity it saw. At the time, The Hacker News wrote that "there are currently no public reports about in-the-wild abuse of CVE-2023-34192." No campaign naming it has been published since, as of Oct 23, 2026.

One mix-up is on record. In July 2023, Zimbra warned of a different XSS that Google's Threat Analysis Group had seen exploited, and Help Net Security reported that zero-day under this CVE ID. Zimbra's advisory table and later coverage tie that bug to CVE-2023-37580, fixed in 8.8.15 Patch 41. Nothing public shows whether the mix-up played any part in CISA's decision.

Who is affected#

Only Zimbra 8.8.15 below Patch 40 is listed. The bigger issue is 8.8.15 itself. Zimbra's release table shows 8.8.15 reached end of technical guidance on December 31, 2024, and 9.0 on June 30, 2025. A server patched for this bug can still be missing every fix released since.

Do you really need to act?#

Only if you still run 8.8.15. Exploitation needs a valid account plus some user interaction (NVD rates it PR:L, UI:R). So the realistic attacker is someone with a phished or reused password, or a malicious insider, going after other users' sessions. If your servers are on Zimbra 10.1, you can relax about this CVE. If any 8.8.15 node is left, the job is migration, not this patch.

What to do now#

1. Check every node: su - zimbra -c "zmcontrol -v".
2. If a node is below 8.8.15 Patch 40, patch it now as a stopgap.
3. Migrate off 8.8.15 to the current 10.1 patch. Zimbra shipped 10.1.20 in July 2026.
4. Until then, put webmail behind a VPN or IP allowlist, and enforce strong passwords or 2FA.
5. Review accounts for forwarding and filter rules their owners did not create.

How to tell if you were hit#

No indicators have been published for this CVE, so look for what XSS in a mail client typically leaves behind:

• Unexpected forwarding: zmprov sa "(zimbraPrefMailForwardingAddress=*)" lists accounts that forward mail. Confirm each one.
• Odd logins: review /opt/zimbra/log/audit.log for sessions from unfamiliar addresses.
• Autosave requests carrying markup: grep -i 'autoSaveDraft' /opt/zimbra/log/access_log.* | grep -iE 'script|onerror|javascript'. POST bodies are not logged, so a clean result proves little.

If you find signs of abuse, reset the affected passwords and review the server as a whole, since unsupported versions carry other known flaws.

Timeline#

• May 30, 2023 — Zimbra releases 8.8.15 Patch 40 with the fix.
• Jul 6, 2023 — CVE-2023-34192 is published.
• Jul 17, 2023 — Help Net Security links a separate Zimbra zero-day to this CVE ID; it is later tracked as CVE-2023-37580.
• Dec 31, 2024 — Zimbra 8.8.15 reaches end of technical guidance.
• Feb 25, 2025 — CISA adds CVE-2023-34192 to KEV.
• Mar 18, 2025 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2023-34192 · KEV 2025-02-25 · Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Zimbra — Zimbra Collaboration 8.8.15 Patch 40 release notes (archived) web.archive.org
2. Zimbra — Security Advisories (archived Jan 2026) web.archive.org
3. CVE record — CVE-2023-34192 cve.org
4. NVD — CVE-2023-34192 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2023-34192 cisa.gov
6. CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Feb 25, 2025) cisa.gov
7. Zimbra — Zimbra Releases and lifecycle (archived Jun 2026) web.archive.org
8. Zimbra — Patch Release Update: Zimbra 10.1.20 (Jul 20, 2026) blog.zimbra.com

Coverage and analysis

1. The Hacker News — CISA adds Microsoft and Zimbra flaws to KEV catalog (Feb 26, 2025) thehackernews.com
2. Help Net Security — Critical XSS vulnerability in Zimbra exploited in the wild (Jul 17, 2023) helpnetsecurity.com
3. The Hacker News — Zimbra warns of critical zero-day flaw (Jul 2023, updated with CVE-2023-37580) thehackernews.com