Loading vulnerability…
Stored XSS in Zimbra Collaboration Classic UI
CVE-2025-66376 is a stored cross-site scripting vulnerability affecting the Classic UI of Zimbra Collaboration 10.0 before 10.0.18 and 10.1 before 10.1.13. The client-side HTML sanitizer inadequately handles CSS @import directives in crafted HTML emails. Attackers can fragment executable markup with fake @import directives and HTML comments so that sanitization allows the browser to reconstruct and execute malicious JavaScript. Opening or previewing the message triggers execution within the recipient’s authenticated webmail session, without a link click or attachment opening. The vulnerability was exploited as a zero-day in espionage campaigns deploying ZimReaper.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attacker-controlled JavaScript can access information and perform account operations available within the victim’s authenticated Zimbra session. Observed exploitation stole recent emails, Global Address List entries, account metadata, CSRF tokens, browser-autofilled passwords, and two-factor authentication material. Attackers also created application-specific passwords to maintain IMAP, POP3, and SMTP access without two-factor authentication. This enables persistent mailbox theft and follow-on phishing from compromised accounts. The vulnerability is browser-session XSS, not direct server-side operating-system code execution.
If you can’t patch tonight, do this now.
If patching is delayed, limit or suspend use of the Classic UI. Monitor Zimbra account and API activity for unexpected application-password creation, recovery-code retrieval, bulk address-list queries, and mailbox exports. Monitor DNS and HTTPS traffic for suspicious exfiltration. Restrict affected accounts and invalidate sessions when compromise is suspected. Third-party authentication supporting passkeys can reduce risks from stolen credentials, but authentication controls do not replace patching or removal of persistent application passwords.
Patch, then assume compromise.
Upgrade affected installations to a supported release containing the fix. The initial fixed versions were Zimbra Collaboration 10.0.18 and 10.1.13; the 10.0 branch subsequently reached end of life. Investigate potential pre-patch compromise because updating does not revoke previously stolen authentication material or attacker-created application passwords. Reset affected passwords, invalidate active sessions, regenerate two-factor recovery codes, remove unauthorized application-specific passwords, and review logs for suspicious authentication, mailbox exports, address-list enumeration, and application-password creation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
157 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.