Zimbra flaw can expose email and account data

Published July 23, 2026 CVE-2025-66376

Zimbra's webmail can run attacker-controlled JavaScript when someone views a malicious email. Reported attacks used the flaw to steal emails, passwords, and two-factor authentication tokens.

Severity
HighCVSS 3.1 · 7.2
Fix
Fixed in 10.0.18
Affected versions
10.0 to before 10.0.18; 10.1 to before 10.1.13
Weakness
CWE-79Cross-site Scripting (XSS)
Exploit likelihood
20% in 30 daysEPSS, higher than 97% of known flaws
Affects
Collaboration
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Mar 18, 2026
Federal fix deadline
Apr 1, 2026

How it works

  • An attacker places CSS @import instructions in an HTML email.
  • The Classic UI mishandles those instructions when displaying the message.
  • Viewing the malicious email can trigger arbitrary JavaScript without another interaction.

What to do

Ask the Zimbra administrator to confirm whether the server runs ZCS 10.0 through 10.0.17 or ZCS 10.1 through 10.1.12. Those versions fall within the affected ranges listed for this advisory.

Update ZCS to 10.0.18 or 10.1.13, the fixed versions listed for this advisory. If updating is not immediately possible, switch to another webmail client temporarily.

Technical details

Affected software: Collaborationby Zimbra

TA488, also known as Laundry Bear or Void Blizzard, used the flaw against NATO, Ukrainian government organizations, defense companies, US agencies, and scientific organizations. Reports say the group exfiltrated emails, passwords, two-factor authentication tokens, and other sensitive information.

CVE-2025-66376 is a stored cross-site scripting flaw in Zimbra Collaboration's Classic UI. CSS @import instructions in an HTML email can trigger arbitrary JavaScript when the message is viewed. Zimbra fixed the issue in 10.0.18 and 10.1.13.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact Low Some data can be read
  • Integrity impact Low Some data can be modified
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Open in FIRST.org calculator

References

View Original Source