NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Zimbra Classic webmail flaw CVE-2025-66376 used to steal emails; fixes available

Attackers used CVE-2025-66376 to steal emails through Zimbra Classic webmail. Opening or previewing a malicious email could trigger it. Ask your mail provider or IT team to confirm patching and check for unauthorised account access.

What to do

If your email uses Zimbra, ask your provider or IT team to confirm it runs a supported 10.1 release containing the fix first shipped in 10.1.13. If your account may have been targeted, ask them to investigate access and remove unauthorised app passwords, including unexpected entries named ZimbraWeb.

What’s happening

CVE-2025-66376 lets a malicious HTML email run attacker-controlled JavaScript when opened or previewed in vulnerable Zimbra Classic webmail. It affects Zimbra Collaboration 10.0 before 10.0.18 and 10.1 before 10.1.13. Zimbra released both fixes on 6 November 2025; the 10.0 branch subsequently reached end of life on 31 December. CISA confirmed exploitation by listing the flaw on 18 March 2026. In July, Proofpoint reported that the Russia-aligned TA488 group had used it since at least July 2025 against Ukrainian government entities and US government, scientific and defence targets. The campaign stole emails and credentials and established persistent access. Proofpoint said it had seen no TA488 activity since February 2026, but that observation does not establish that exploitation has ended. As at 3 November, fixes remain available; potentially compromised accounts also need investigation.

What
Flaw
Affects
Zimbra Collaboration Suite (ZCS), Classic webmail
Affected
Zimbra Collaboration 10.0 before 10.0.18, Classic UI
Zimbra Collaboration 10.1 before 10.1.13, Classic UI
Fixed in
Zimbra Collaboration 10.0.18
Zimbra Collaboration 10.1.13
CVE
CVE-2025-66376
Since
18 Mar 2026
Closed
23 July 2026

Timeline

  1. Update

    Proofpoint documented TA488 attacks dating back to at least July 2025 against Ukrainian government and US government, scientific and defence targets. It reported stolen emails and credentials, but said it had observed no TA488 activity since February 2026.

  2. CISA added

    CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities catalogue. US federal civilian agencies were given until 1 April to address it.

  3. Made public

    The CVE-2025-66376 record was published, identifying affected versions as Zimbra 10.0 before 10.0.18 and 10.1 before 10.1.13.

  4. Update

    Zimbra 10.0 reached its announced end of life. Zimbra advised customers to move to the supported 10.1 branch for continued security updates.

  5. New fixFixed

    Zimbra released 10.0.18 and 10.1.13, fixing a stored cross-site scripting flaw in Classic webmail involving HTML email formatting.

Sources

  1. Zimbra Security AdvisoriesZimbra
  2. Zimbra Daffodil 10.0.18 Patch ReleaseZimbra · 6 Nov 2025
  3. Zimbra Daffodil 10.1.13 Patch ReleaseZimbra · 6 Nov 2025
  4. Security CenterZimbra
  5. CISA orders feds to patch Zimbra XSS flaw exploited in attacksBleepingComputer · 18 Mar 2026
  6. TA488 Targets Zimbra Mailservers with Half-Click ExploitsProofpoint · 23 July 2026
  7. CVE-2025-66376: reproduced CVE, NVD and CISA recordsCIRCL · 19 Mar 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS