CVE-2025-66376

This flaw lets an attacker hide malicious instructions inside an email so that when a Zimbra webmail user opens that message, the attacker’s code runs inside the user’s browser. Think of it like a fake “receipt” email that looks normal, but when opened, it quietly steals login/session information and other sensitive data stored in the browser and mailbox.

This matters if you run Zimbra Collaboration Suite (ZCS) “Classic UI” webmail and users can access it through a browser. It’s relevant even if you don’t think of yourself as a high-profile target—real attackers have used this in campaigns against organizations. Because this is triggered when a victim views the crafted email, the risk is mainly: if your users receive and open malicious emails in a Zimbra Classic UI environment.

This is a RED issue because it has confirmed real-world exploitation, and Zimbra webmail can be abused to execute attacker code inside a user’s browser when they view a crafted email. Attackers used it to steal credentials, session information, 2FA codes, and access mailbox contents, so the impact can be direct and immediate.

1. Confirm exposure (what to check)

   • Determine your installed Zimbra Collaboration Suite version.
   • Confirm whether you are using Zimbra Classic UI webmail.
   • Affected software versions (from the advisory):
     • Collaboration: 10.0.x before 10.0.18
     • Collaboration: 10.1.x before 10.1.13

2. Upgrade to the fixed versions (preferred path)

   • Upgrade the Zimbra Collaboration branch you’re on:
     • If on 10.0.x, upgrade to 10.0.18.
     • If on 10.1.x, upgrade to 10.1.13.
   • Plan a maintenance window and verify the upgrade successfully completes before restoring normal operations.
   • Note: the fix is specific to these fixed versions; avoid assuming that “minor updates” beyond them are safe unless they match the fixed version numbers.

3. If patching is delayed (temporary containment)

   • Apply the mitigations provided by Zimbra via their security advisories page (per the vendor remediation guidance in the findings).
   • Operationally, reduce exposure by tightening email handling and user access controls in the ways your vendor guidance specifies (for example, limiting the ability for users to view untrusted HTML emails in the impacted UI until the fix is applied).

4. Validate and hunt after changes

   • Search mailboxes for suspicious emails that users opened around the incident timeframe.
   • Review signs of compromise that match the reported abuse patterns: unexpected logins, session anomalies, password resets, and 2FA-related events.
   • Ensure affected users sign out/in as required and reset credentials only if the investigation indicates compromise.

5. Compliance timing (KEV)

   • CISA KEV due date for remediation: 2026-04-01 (apply the vendor mitigations per instructions if you can’t upgrade immediately).

6. What to monitor going forward

   • Monitor for recurring malicious email delivery patterns and user session anomalies.
   • Track alerts related to suspicious authentication/session behavior and unexpected changes to mailbox state.

Severity is HIGH (CVSS 7.2) and the practical risk is elevated because this is stored XSS in Zimbra Classic UI that attackers can leverage via email content. The weakness is CWE-79 (Cross-site Scripting). Mechanism: an attacker injects malicious CSS @import directives into an HTML email; the payload is stored and later executed in the victim’s browser when they view the message, enabling JavaScript execution in the context of the user’s session (allowing theft of session tokens and other browser-held secrets, consistent with the reported real-world campaign behavior).

Exploitation status: Confirmed exploitation via CISA KEV and multiple news reports (first reported 2025-07-01) with state-sponsored actors (Laundry Bear / Void Blizzard) using it for persistence and credential/session theft; no public exploit code is on record.

EPSS is reported as rising (12.0% 96th percentile), but because KEV/news confirm exploitation, the operational priority should follow the KEV/confirmed exploitation rather than EPSS prediction.

Reachability/authentication: Findings state authentication required is none and user interaction is none beyond viewing the crafted email message in the webmail UI; this makes it particularly dangerous for mail-based delivery within organizations using impacted Zimbra versions.