Vulnerability intelligence
CVE-2025-66376
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CVSS Score
7.2
High
EPSS — Exploit Probability
20%
Riskier than 97% of all CVEs · checked 2026-09-06
Exploitation
Confirmed in the wild
KEV since 2026-03-18
Remediation
Patch available
Federal deadline 2026-04-01
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-04-01.
12 articles across 9 outlets · first covered Jul 23, 2026 · latest Jul 25, 2026
Associated threat actors
Coverage timeline
-
Zimbra XSS bug CVE‑2025-66376 lets Russian hackers steal mailsocradar.io · Jul 25, 2026
-
US agencies warn Laundry Bear exploits CVE-2025-66376 in Zimbrasecurityaffairs.com · Jul 24, 2026
-
LAUNDRY BEAR Uses CVE-2025-66376 to Hack Zimbra via Phishingwww.cisa.gov · Jul 23, 2026
-
Russian zero-click attack exploits Zimbra flaw CVE-2025-66376www.infosecurity-magazine.com · Jul 23, 2026
-
Russian hackers exploit Zimbra flaw in zero click email campaignunit42.paloaltonetworks.com · Jul 23, 2026
-
Russian APT targets Ukraine via Zimbra XSS flaw CVE-2025-66376securityaffairs.com · Mar 19, 2026
-
Russian hackers exploit Zimbra flaw in Ukrainian govt attacksdatabreaches.net · Mar 19, 2026
-
Russian APT Exploits Zimbra Vulnerability Against Ukrainewww.securityweek.com · Mar 19, 2026
-
CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacksthehackernews.com · Mar 19, 2026
-
U.S. CISA adds Microsoft SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalogsecurityaffairs.com · Mar 18, 2026
-
CISA Adds CVE-2025-66376 to Known Exploited Vulnerabilities Cataloguewww.cisa.gov · Mar 18, 2026
-
CISA Adds CVE-2025-66376 to Known Exploited Vulnerabilities Cataloguecisa.gov · Mar 18, 2026