CISA has added a new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. This new entry is CVE-2025-27915, affecting Synacor Zimbra Collaboration Suite (ZCS) with a Cross-site Scripting vulnerability. Such vulnerabilities are common attack vectors used by malicious actors, posing significant risks. Binding Operational Directive (BOD) 22-01 established the KEV Catalog for vulnerabilities with substantial risks to the federal enterprise. This directive mandates Federal Civilian Executive Branch (FCEB) agencies to fix these vulnerabilities by their due dates. The goal is to protect FCEB networks from active threats. While BOD 22-01 specifically targets FCEB agencies, CISA recommends all organizations address KEV Catalog vulnerabilities. Prioritizing these remediations is crucial for effective vulnerability management. CISA will continue to update the catalog with new vulnerabilities that meet specific criteria. This ongoing process aims to enhance overall cybersecurity defenses.