Loading story…
CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities catalog after reports of active exploitation against Zimbra Collaboration Suite. The high-severity flaw affects the Classic UI and lets an unauthenticated remote attacker trigger stored/persistent XSS by sending malicious HTML email that abuses the CSS @import directive, potentially exposing sensitive information and creating a path to further compromise.
The vulnerability affects Zimbra Collaboration Suite versions earlier than 10.0.18 and 10.1.13. Synacor patched the issue in November 2025, and Zimbra security advisories list the fixed releases; organizations running vulnerable versions have been urged to upgrade immediately to 10.0.18, 10.1.13, or later because the flaw is already being exploited in the wild.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities catalog after determining the Zimbra Collaboration Suite flaw was being actively exploited. The vulnerability enables unauthenticated persistent XSS and could lead to sensitive information disclosure or possible remote code execution.
Synacor patched CVE-2025-66376, a high-severity stored XSS vulnerability in the Zimbra Classic UI, in November 2025. The flaw affects versions earlier than 10.0.18 and 10.1.13 and can be triggered via malicious HTML emails abusing the CSS @import directive.
Threat actors attributed with medium confidence to Russian groups including TA488, CL-STA-1114, and APT28 have exploited the Zimbra stored XSS flaw since at least July 2025 in a campaign dubbed Operation GhostMail. The activity targeted Western government, defense, transportation, financial organizations, and Ukraine, enabling mailbox compromise and theft of session tokens, passwords, 2FA scratch codes, and mailbox data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA** added **CVE-2025-66376** to its **Known Exploited Vulnerabilities (KEV)** catalog after confirming active exploitation of a **stored cross-site scripting (XSS)** flaw in **Synacor Zimbra Collaboration Suite (ZCS)**. The vulnerability affects the *Classic UI* and allows remote unauthenticated attackers to abuse CSS `@import` directives embedded in email HTML, creating a path to execute malicious JavaScript in a victim's browser session. The KEV entry describes the issue as a **CWE-79** XSS vulnerability and directs organizations to apply vendor mitigations, follow **BOD 22-01** guidance for cloud services, or discontinue use if mitigations are unavailable. CISA ordered **Federal Civilian Executive Branch (FCEB)** agencies to remediate the flaw by **April 1**, while also urging private-sector organizations to patch quickly because the bug is being exploited in the wild. Reporting on the KEV addition notes that the flaw was patched by Zimbra earlier and could enable session hijacking and theft of sensitive data within affected Zimbra environments through malicious HTML email content. The same KEV update also included other unrelated vulnerabilities, but the Zimbra entry is the relevant event tied to the active exploitation warning and federal patching directive.
Jun 29, 2026
More than 10,000 internet-exposed **Zimbra Collaboration Suite** servers remain vulnerable to `CVE-2025-48700`, an actively exploited cross-site scripting flaw that affects ZCS versions `8.8.15`, `9.0`, `10.0`, and `10.1`. The bug lets unauthenticated attackers execute arbitrary JavaScript in a victim’s session and steal sensitive data when a user opens a malicious email in the **Zimbra Classic UI**. Synacor released patches in June 2025, but Shadowserver still reported roughly **10,500** exposed unpatched systems, with the largest concentrations in Asia and Europe. **CISA** has added `CVE-2025-48700` to its **Known Exploited Vulnerabilities** catalog and ordered Federal Civilian Executive Branch agencies to secure affected servers within days because the flaw is being abused in the wild. The warning follows a broader pattern of Zimbra vulnerabilities being used in espionage-focused campaigns, with reporting linking earlier exploitation of similar flaws to Russian-aligned groups including **APT28**, **APT29**, and **Winter Vivern** against Ukrainian entities, NATO-aligned organizations, and other targets.
Jun 29, 2026
Zimbra has urged customers to upgrade to **Zimbra Collaboration 10.1.19** to remediate a critical stored cross-site scripting flaw in the **Classic Web Client**. The vulnerability, which does not yet have a CVE identifier, can be triggered through a specially crafted email and may execute malicious code when a user opens the message in the Classic UI. Successful exploitation could expose **session data, account settings, and mailbox contents**, creating a direct path to account compromise and data theft. The issue was reported by **Google Threat Analysis Group**, and Zimbra said it has **no evidence of active exploitation** so far. The warning has drawn added attention because Zimbra products have been repeatedly targeted in recent years by Russian state-linked groups including **Winter Vivern**, **APT29**, and **APT28**, while other Zimbra flaws have also appeared in **CISA KEV** and been used in campaigns against government, military, and Ukrainian entities.
Jul 23, 2026