CISA Adds Actively Exploited Zimbra XSS Flaw to KEV Catalog

CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation of a stored cross-site scripting (XSS) flaw in Synacor Zimbra Collaboration Suite (ZCS). The vulnerability affects the Classic UI and allows remote unauthenticated attackers to abuse CSS @import directives embedded in email HTML, creating a path to execute malicious JavaScript in a victim's browser session. The KEV entry describes the issue as a CWE-79 XSS vulnerability and directs organizations to apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

CISA ordered Federal Civilian Executive Branch (FCEB) agencies to remediate the flaw by April 1, while also urging private-sector organizations to patch quickly because the bug is being exploited in the wild. Reporting on the KEV addition notes that the flaw was patched by Zimbra earlier and could enable session hijacking and theft of sensitive data within affected Zimbra environments through malicious HTML email content. The same KEV update also included other unrelated vulnerabilities, but the Zimbra entry is the relevant event tied to the active exploitation warning and federal patching directive.