DaystoPatch

Zimbra (Synacor)Exploited incident

Zimbra Classic UI stored XSS via CSS @import, used by a Russian espionage group (CVE-2025-66376)

CVE-2025-66376High, CVSS 7.2In CISA's Known Exploited Vulnerabilities catalog since 18 Mar 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.13 was released on Thu Nov 06 2025.

    Nothing about the bug was public before the fix releases; exploitation since July 2025 was only revealed later (see notes).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2025-66376ClaimedQuote verified5 Jan 2026, 00:00 UTC

    Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b257938b8f6aac98…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet5 Jan 2026, 16:44 UTC

    CVE-2025-66376 - Zimbra Collaboration Classic UI Stored XSS

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-66376)ClaimedQuote verified18 Mar 2026

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

    Added to CISA's KEV catalog on 2026-03-18.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet23 Mar 2026, 05:00 UTC

    📢 APT28 exploite la faille XSS Zimbra CVE-2025-66376 contre des entités ukrainiennes 📝 ## 🗓️ Contexte Selon un rapport publié par **Seqrite Labs** et relayé par Security Affairs... 📖 cyberveille : https:// cyberveille.ch/posts/2026-03-2

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.13 was released on Thu Nov 06 2025.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.13 was released on Thu Nov 06 2025.

    Security Center entry lists 'Patched a stored XSS vulnerability in the Classic UI where attackers could abuse CSS @import directives in email HTML. CVE-2025-66376'. Advisories table: fixed in 10.1.13 and 10.0.18, reporter NCSC-FI. wiki.zimbra.com was in maintenance on 2026-10-22, so Wayback captures are cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.0.18 was released on Thu Nov 06 2025.

    Both affected supported branches fixed the same day.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Zimbra Collaboration Suite 10.0 before 10.0.18, 10.1 before 10.1.13 (Classic UI)
How we built this timeline

exploited before a fix=true although exploitation was only made public after the fix: The Hacker News (23 Jul 2026), reporting joint advisory AA26-204A (NSA, FBI, CISA and partners), says the actors (LAUNDRY BEAR / TA488 / CL-STA-1114) have been compromising organizations through Zimbra 'since at least July 2025', and that Proofpoint said the group 'exploited the bug as an unknown vulnerability for at least five months during 2025'. Because nothing was public before 6 Nov 2025, world=vendor=First fix and exposure is zero; the zero-day flag records the hidden pre-fix exploitation.

Grouping: CVE-2025-68645 was fixed in the same releases (10.1.13/10.0.18) but is kept as a separate incident (zimbra-cve-2025-68645) because Zimbra's advisories table lists each CVE as its own row, and the two were exploited by different actors at different times. CVSS 7.2 from the CVE record's CNA (MITRE) metric;

THN reports 6.1.

Related

Zimbra (Synacor) report card