CISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation

CVE-2023-34192 is a critical (CVSS 3.1: 9.0) cross-site scripting (CWE-79) flaw in Synacor Zimbra Collaboration Suite (ZCS) 8.8.15. A remote, authenticated attacker submits a crafted script through the /h/autoSaveDraft endpoint (the autosave-draft handler of the web client), and because the vulnerability requires user interaction and changes scope, the script can execute in another user's browser session. By running code/actions in the security context of the victim's session, the attacker gains high-impact access to confidentiality, integrity, and availability (C:H/I:H/A:H per the CVSS vector). Organizations running ZCS 8.8.15 are affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-02-25 amid reported active exploitation, and EPSS is at 77.3% (100th percentile), though no public proof-of-concept is known.

Do: Upgrade ZCS 8.8.15 deployments to the latest available patch release per Synacor/Zimbra's instructions (or move to a supported release), as required by CISA's KEV listing and BOD 22-01 guidance for federal agencies. In the interim, restrict who can reach the /h/autoSaveDraft handler, review logs for suspicious POSTs to that endpoint and for injected drafts, and hunt for indicators of compromise such as unexpected mailbox rules or account activity.

An improper access-control flaw (CWE-269) in Microsoft's Partner Center portal at Partner.Microsoft.com allows an unauthenticated, remote attacker to elevate privileges over the network, earning a critical CVSS 3.1 score of 9.8. The flaw is triggered by network requests to the internet-facing portal that bypass access-control checks, requiring no credentials or user interaction. A successful attacker gains elevated privileges within Partner Center, the portal partners use to manage Microsoft cloud customer tenants and reseller relationships, potentially exposing partner and customer management functions. Any organization using Microsoft Partner Center — typically CSP partners, direct bill partners, and indirect resellers — is affected. The flaw is actively exploited: Microsoft addressed it in its November 2024 security fixes with exploitation seen in active attacks, and CISA added it to the KEV catalog on 2025-02-25.

Do: Partner Center is a Microsoft-managed cloud service, so no customer-side upgrade version applies — confirm with Microsoft that the service-side fix is in place, and federal agencies must follow BOD 22-01/KEV required actions (apply vendor mitigations or discontinue use). Review Entra ID sign-in logs and Partner Center audit logs for unauthenticated access, unexpected role or privilege changes, and anomalous app registrations or consent grants, and rotate credentials for affected partner accounts if compromise is suspected.