Zimbra bug can expose secrets

Published July 23, 2026 CVE-2025-66376

A newly disclosed flaw in Zimbra's webmail let a Russian state-backed spying group read a person's inbox just by having them open a booby-trapped email. Once triggered, it stole the person's saved browser password, two-factor recovery codes, and up to 90 days of their mail.

Severity
HighCVSS 3.1 · 7.2
Fix
Fixed in 10.0.18
Affected versions
10.0 to before 10.0.18; 10.1 to before 10.1.13
Weakness
CWE-79Cross-site Scripting (XSS)
Exploit likelihood
20% in 30 daysEPSS, higher than 97% of known flaws
Affects
Collaboration
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Mar 18, 2026
Federal fix deadline
Apr 1, 2026

How it works

  • The email hides a snippet of code inside fake formatting instructions that Zimbra's cleanup filter does not recognize as dangerous.
  • When the filter strips out the decoy parts, the leftover fragments snap together into working code that runs the instant the message displays, with the same access as the person who opened it.

What to do

Check your organization's installed Zimbra Collaboration build with zmcontrol -v on the mail server and compare it against 10.0.18 or 10.1.13. Zimbra fixed the flaw on November 6, 2025, so update to Zimbra Collaboration 10.0.18, 10.1.13, or later through the normal Zimbra update process, and because the bug already let attackers steal passwords and 2FA recovery codes before the patch existed, also force a password reset, re-enroll two-factor authentication, and check the account's app-specific passwords for one...

Update Russian Espionage through its normal update channel, then confirm the installed version matches the newest vendor release.

Technical details

Affected software: Collaborationby Zimbra

CVE-2025-66376 is a stored XSS in Zimbra Collaboration's Classic UI, exploited via CSS @import handling: an HTML email hides an svg onload tag inside a display:none div, splits it with fake @import directives and comments, and Zimbra's sanitizer strips only the decoy fragments, leaving behind <svg onload=eval(atob(...)) to execute in the authenticated session. NVD scores it 6.1 and calls it user-interaction-required; MITRE scores it 7.2 and calls it none; Unit 42 calls it zero-click, since simply rendering the message triggers it. Proofpoint's payload, ZimReaper, steals the CSRF token and autofilled password, pulls 2FA scratch codes via Zimbra's own APIs, exfiltrates over DNS, brute-forces the Global Address List, and archives 90 days of mail. It also calls CreateAppSpecificPasswordRequest to mint an app-specific password ('ZimbraWeb') granting IMAP/POP3/SMTP access that bypasses 2FA.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact Low Some data can be read
  • Integrity impact Low Some data can be modified
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Open in FIRST.org calculator

References

View Original Source