CVE-2025-66376: high-severity vulnerability in Zimbra Collaboration
Published · Updated
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Zimbra Collaboration allows attackers to inject malicious code into email messages through CSS styling tricks. When a victim views the email in the Classic UI, the injected code runs in their browser, potentially stealing data or compromising their account.
Stored XSS vulnerability in Zimbra ZCS 10.x (before 10.0.18 and 10.1.x before 10.1.13) via CSS @import directives in HTML email messages. Attack vector is network-based; an attacker sends a crafted email that executes JavaScript in the context of the recipient's Classic UI session. Impact includes session hijacking, credential theft, and unauthorized actions on behalf of the victim.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.