CVE-2025-66376

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-66376 7.2

Synacor · Zimbra Collaboration Suite (ZCS) · Added 2026-03-18 · Published 2026-01-05

KEV Active Exploitation

Details

VulnerabilitySynacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

VendorSynacor

ProductZimbra Collaboration Suite (ZCS)

Date added2026-03-18

Due date2026-04-01

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-79

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Descriptions

KEV: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.

NVD: Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

Compliance SSVC + BOD 26-04

Automatableno

Technical impactpartial

Exploitation statusactive

3-day qualifyingNo

Public timeline14 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-06-12 21:01 UTC

Wall time30.0s

Searches2

Component defaultunknown

Sources https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Security_Center
https://nvd.nist.gov/vuln/detail/CVE-2025-66376
https://securityaffairs.com/189673/security/russian-apt-targets-ukraine-via-zimbra-xss-flaw-cve-2025-66376.html
https://www.sentinelone.com/vulnerability-database/cve-2025-66376/
https://www.rapid7.com/db/vulnerabilities/zimbra-collaboration-cve-2025-66376/

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Monitor for inbound HTML email messages containing CSS @import directives targeting the Zimbra Classic UI to achieve stored cross-site scripting.

Research details

ComponentZimbra Classic UI

PreconditionsAttacker sends a crafted HTML email message to a Zimbra user; no authentication required for email delivery; the user must open the email in the Zimbra Classic UI for the stored XSS to execute agent

DeliveryHTML email

Public PoCno

Advisoryhttps://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.0–8.9)

SummaryStored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite Classic UI where an attacker can inject malicious JavaScript via CSS @import directives within an HTML email message, enabling account takeover and data theft when the victim opens the email in the Classic UI. Exploited by Russian APT group APT28 (Operation GhostMail) targeting Ukrainian government entities.

Tia coverage

First reported2026-05-16

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

laundry-bear-void-blizzard-zimbra-zero-click-espionage-joint-int microsoft-exchange-server-zero-day-cve-2026-42897-active-owa-spo

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.