{"id":"zimbra-classic-email-theft-mar-2026","category":"patch","status":"closed","title":"Zimbra Classic webmail flaw CVE-2025-66376 used to steal emails; fixes available","tldr":"Attackers used CVE-2025-66376 to steal emails through Zimbra Classic webmail. Opening or previewing a malicious email could trigger it. Ask your mail provider or IT team to confirm patching and check for unauthorised account access.","summary":"CVE-2025-66376 lets a malicious HTML email run attacker-controlled JavaScript when opened or previewed in vulnerable Zimbra Classic webmail. It affects Zimbra Collaboration 10.0 before 10.0.18 and 10.1 before 10.1.13. Zimbra released both fixes on 6 November 2025; the 10.0 branch subsequently reached end of life on 31 December. CISA confirmed exploitation by listing the flaw on 18 March 2026. In July, Proofpoint reported that the Russia-aligned TA488 group had used it since at least July 2025 against Ukrainian government entities and US government, scientific and defence targets. The campaign stole emails and credentials and established persistent access. Proofpoint said it had seen no TA488 activity since February 2026, but that observation does not establish that exploitation has ended. As at 3 November, fixes remain available; potentially compromised accounts also need investigation.","action":"If your email uses Zimbra, ask your provider or IT team to confirm it runs a supported 10.1 release containing the fix first shipped in 10.1.13. If your account may have been targeted, ask them to investigate access and remove unauthorised app passwords, including unexpected entries named ZimbraWeb.","product":"Zimbra Collaboration Suite (ZCS), Classic webmail","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-66376"],"tags":["synacor","zimbra","webmail","xss","email-theft","actively-exploited"],"affected":["Zimbra Collaboration 10.0 before 10.0.18, Classic UI","Zimbra Collaboration 10.1 before 10.1.13, Classic UI"],"fixed":["Zimbra Collaboration 10.0.18","Zimbra Collaboration 10.1.13"],"matches":[],"sources":[{"kind":"advisory","title":"Zimbra Security Advisories","url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","by":"Zimbra","date":""},{"kind":"advisory","title":"Zimbra Daffodil 10.0.18 Patch Release","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18","by":"Zimbra","date":"2025-11-06"},{"kind":"advisory","title":"Zimbra Daffodil 10.1.13 Patch Release","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13","by":"Zimbra","date":"2025-11-06"},{"kind":"advisory","title":"Security Center","url":"https://wiki.zimbra.com/wiki/Security_Center","by":"Zimbra","date":""},{"kind":"news","title":"CISA orders feds to patch Zimbra XSS flaw exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-zimbra-xss-flaw-exploited-in-attacks/","by":"BleepingComputer","date":"2026-03-18"},{"kind":"research","title":"TA488 Targets Zimbra Mailservers with Half-Click Exploits","url":"https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits","by":"Proofpoint","date":"2026-07-23"},{"kind":"advisory","title":"CVE-2025-66376: reproduced CVE, NVD and CISA records","url":"https://cve.circl.lu/vuln/CVE-2025-66376","by":"CIRCL","date":"2026-03-19"}],"started":"2026-03-18","closed":"2026-07-23","created":"2026-11-03T22:26:34.887Z","updated":"2026-11-03T22:26:34.887Z","cve_notes":[{"cve":"CVE-2025-66376","name":"Stored cross-site scripting in Zimbra Classic webmail","what":"Zimbra Classic webmail mishandles CSS @import directives in HTML emails, allowing a malicious message to run JavaScript in the recipient’s browser and access their email account.","severity":"unknown","cvss":6.1}],"timeline":[{"at":"2026-07-23","added":"2026-11-03T22:23:50.754Z","kind":"other","text":"Proofpoint documented TA488 attacks dating back to at least July 2025 against Ukrainian government and US government, scientific and defence targets. It reported stolen emails and credentials, but said it had observed no TA488 activity since February 2026.","url":"https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits","by":"Proofpoint","patch":null},{"at":"2026-03-18","added":"2026-11-03T22:23:50.754Z","kind":"cisa-added","text":"CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities catalogue. US federal civilian agencies were given until 1 April to address it.","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-zimbra-xss-flaw-exploited-in-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-01-05","added":"2026-11-03T22:23:50.754Z","kind":"disclosed","text":"The CVE-2025-66376 record was published, identifying affected versions as Zimbra 10.0 before 10.0.18 and 10.1 before 10.1.13.","url":"https://cve.circl.lu/vuln/CVE-2025-66376","by":"CIRCL, reproducing the MITRE CVE record","patch":null},{"at":"2025-12-31","added":"2026-11-03T22:23:50.754Z","kind":"other","text":"Zimbra 10.0 reached its announced end of life. Zimbra advised customers to move to the supported 10.1 branch for continued security updates.","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18","by":"Zimbra","patch":null},{"at":"2025-11-06","added":"2026-11-03T22:23:50.754Z","kind":"new-fix","text":"Zimbra released 10.0.18 and 10.1.13, fixing a stored cross-site scripting flaw in Classic webmail involving HTML email formatting.","url":"https://wiki.zimbra.com/wiki/Security_Center","by":"Zimbra","patch":"patched"}],"url":"https://hard.fyi/live/zimbra-classic-email-theft-mar-2026/","json":"https://hard.fyi/api/live?id=zimbra-classic-email-theft-mar-2026"}