---
title: "Zimbra CVE-2023-34192: 2023 XSS Added to KEV in 2025"
url: https://erroneo.us/security/briefs/zimbra-8-8-15-cve-2023-34192-autosavedraft-xss/
description: "Authenticated XSS in Zimbra 8.8.15's /h/autoSaveDraft, fixed in Patch 40 (May 2023), KEV-listed Feb 2025 with no public campaign. 8.8.15 is EOL: migrate."
type: security-brief
section: "Security Digest"
date_published: 2023-05-30
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-34192"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Zimbra CVE-2023-34192: 2023 XSS Added to KEV in 2025

**Verdict: Check exposure.** The bug was fixed in May 2023 and only hits Zimbra 8.8.15; the real problem is any 8.8.15 server still running, because that branch stopped receiving fixes at the end of 2024.

- **Who must act:** Anyone still running Zimbra Collaboration 8.8.15, and above all servers below Patch 40 or with the web client reachable from the internet.
- **Who can relax:** Zimbra servers on a current 10.1 patch and organizations that do not run self-hosted Zimbra.
- **Affected:** Zimbra Collaboration Suite 8.8.15 before Patch 40
- **Fixed:** Zimbra 8.8.15 Patch 40 (May 30, 2023); Supported path today: Zimbra 10.1 at the latest patch
- **CVEs:** CVE-2023-34192
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the version on every Zimbra node with su - zimbra -c 'zmcontrol -v'.
2. If any node is below 8.8.15 Patch 40, patch it now as a stopgap.
3. Plan and run the migration off 8.8.15 to a current Zimbra 10.1 patch.
4. Until migrated, keep webmail behind a VPN or allowlist and require strong passwords or 2FA.
5. Review accounts for forwarding rules and filters that users did not set.

### How to check if you are affected

- Search accounts for unexpected forwarding addresses with zmprov sa '(zimbraPrefMailForwardingAddress=*)'.
- Review /opt/zimbra/log/audit.log for logins from unfamiliar addresses.
- Grep /opt/zimbra/log/access_log.* for requests to /h/autoSaveDraft carrying script tags or event handlers.

## What happened

Zimbra fixed CVE-2023-34192 in Zimbra Collaboration 8.8.15 Patch 40, released May 30, 2023. The [release notes](https://web.archive.org/web/20250101094838/https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P40) list it as "a possible Cross-site Scripting (XSS) security vulnerability" rated High. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-34192), published July 6, 2023, says it lets "a remote authenticated attacker" execute arbitrary code via a crafted script to the `/h/autoSaveDraft` function, the draft autosave in the classic HTML client. Zimbra's [advisory table](https://web.archive.org/web/20260113200508/https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories) credits Skay of Noah-Lab. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-34192) scores it CVSS 3.1 9.0. In practice, "arbitrary code" means script running in a victim's webmail session, with access to their mail and settings.

On February 25, 2025, almost two years after the patch, CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34192) with a March 18 deadline. The [alert](https://www.cisa.gov/news-events/alerts/2025/02/25/cisa-adds-two-known-exploited-vulnerabilities-catalog) cites "evidence of active exploitation" and pairs it with a Microsoft Partner Center flaw.

**Why it reached KEV in 2025:** no public reason is documented. CISA did not describe the activity it saw. At the time, [The Hacker News](https://thehackernews.com/2025/02/cisa-adds-microsoft-and-zimbra-flaws-to.html) wrote that "there are currently no public reports about in-the-wild abuse of CVE-2023-34192." No campaign naming it has been published since, as of Oct 23, 2026.

One mix-up is on record. In July 2023, Zimbra warned of a different XSS that Google's Threat Analysis Group had seen exploited, and [Help Net Security](https://www.helpnetsecurity.com/2023/07/17/cve-2023-34192/) reported that zero-day under this CVE ID. Zimbra's advisory table and later [coverage](https://thehackernews.com/2023/07/zimbra-warns-of-critical-zero-day-flaw.html) tie that bug to CVE-2023-37580, fixed in 8.8.15 Patch 41. Nothing public shows whether the mix-up played any part in CISA's decision.

## Who is affected

Only Zimbra 8.8.15 below Patch 40 is listed. The bigger issue is 8.8.15 itself. Zimbra's [release table](https://web.archive.org/web/20260611101908/https://wiki.zimbra.com/wiki/Zimbra_Releases) shows 8.8.15 reached end of technical guidance on December 31, 2024, and 9.0 on June 30, 2025. A server patched for this bug can still be missing every fix released since.

## Do you really need to act?

Only if you still run 8.8.15. Exploitation needs a valid account plus some user interaction (NVD rates it PR:L, UI:R). So the realistic attacker is someone with a phished or reused password, or a malicious insider, going after other users' sessions. If your servers are on Zimbra 10.1, you can relax about this CVE. If any 8.8.15 node is left, the job is migration, not this patch.

## What to do now

1. Check every node: `su - zimbra -c "zmcontrol -v"`.
2. If a node is below 8.8.15 Patch 40, patch it now as a stopgap.
3. Migrate off 8.8.15 to the current 10.1 patch. Zimbra shipped [10.1.20](https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/) in July 2026.
4. Until then, put webmail behind a VPN or IP allowlist, and enforce strong passwords or 2FA.
5. Review accounts for forwarding and filter rules their owners did not create.

## How to tell if you were hit

No indicators have been published for this CVE, so look for what XSS in a mail client typically leaves behind:

- Unexpected forwarding: `zmprov sa "(zimbraPrefMailForwardingAddress=*)"` lists accounts that forward mail. Confirm each one.
- Odd logins: review `/opt/zimbra/log/audit.log` for sessions from unfamiliar addresses.
- Autosave requests carrying markup: `grep -i 'autoSaveDraft' /opt/zimbra/log/access_log.* | grep -iE 'script|onerror|javascript'`. POST bodies are not logged, so a clean result proves little.

If you find signs of abuse, reset the affected passwords and review the server as a whole, since unsupported versions carry other known flaws.

## Timeline

- May 30, 2023 — Zimbra releases 8.8.15 Patch 40 with the fix.
- Jul 6, 2023 — CVE-2023-34192 is published.
- Jul 17, 2023 — Help Net Security links a separate Zimbra zero-day to this CVE ID; it is later tracked as CVE-2023-37580.
- Dec 31, 2024 — Zimbra 8.8.15 reaches end of technical guidance.
- Feb 25, 2025 — CISA adds CVE-2023-34192 to KEV.
- Mar 18, 2025 — CISA's remediation deadline for federal agencies.

## Sources

1. [Zimbra — Zimbra Collaboration 8.8.15 Patch 40 release notes (archived)](https://web.archive.org/web/20250101094838/https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P40)
2. [Zimbra — Security Advisories (archived Jan 2026)](https://web.archive.org/web/20260113200508/https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)
3. [CVE record — CVE-2023-34192](https://www.cve.org/CVERecord?id=CVE-2023-34192)
4. [NVD — CVE-2023-34192](https://nvd.nist.gov/vuln/detail/CVE-2023-34192)
5. [CISA — Known Exploited Vulnerabilities: CVE-2023-34192](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34192)
6. [CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Feb 25, 2025)](https://www.cisa.gov/news-events/alerts/2025/02/25/cisa-adds-two-known-exploited-vulnerabilities-catalog)
7. [Zimbra — Zimbra Releases and lifecycle (archived Jun 2026)](https://web.archive.org/web/20260611101908/https://wiki.zimbra.com/wiki/Zimbra_Releases)
8. [Zimbra — Patch Release Update: Zimbra 10.1.20 (Jul 20, 2026)](https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/)
9. [The Hacker News — CISA adds Microsoft and Zimbra flaws to KEV catalog (Feb 26, 2025)](https://thehackernews.com/2025/02/cisa-adds-microsoft-and-zimbra-flaws-to.html)
10. [Help Net Security — Critical XSS vulnerability in Zimbra exploited in the wild (Jul 17, 2023)](https://www.helpnetsecurity.com/2023/07/17/cve-2023-34192/)
11. [The Hacker News — Zimbra warns of critical zero-day flaw (Jul 2023, updated with CVE-2023-37580)](https://thehackernews.com/2023/07/zimbra-warns-of-critical-zero-day-flaw.html)

---
Source page: https://erroneo.us/security/briefs/zimbra-8-8-15-cve-2023-34192-autosavedraft-xss/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt