CVE-2025-66376
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Description
CVE-2025-66376 is a high severity stored cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). The flaw exists in the Classic UI's handling of CSS @import directives within HTML email messages, allowing an attacker to inject malicious scripts that execute in the context of another user's browser session. Affected versions include ZCS 10 before 10.0.18 and ZCS 10.1 before 10.1.13. With a CVSS v3.1 score of 7.2 (HIGH) and an EPSS score of 28.8%, CVE-2025-66376 presents significant risk to organizations using Zimbra's web-based email client. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on March 18, 2026, with a remediation deadline of April 1, 2026.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra collaboration suite | >= 10.0.0, < 10.0.18; >= 10.1.0, < 10.1.13 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://wiki.zimbra.com/wiki/Security_Center(Release Notes, Vendor Advisory)
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes(Release Notes)
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes(Release Notes)
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy(Product)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
CVE-2025-66376 is classified under CWE-79 (Cross-site Scripting). This weakness occurs when an application includes untrusted data in web page output without proper sanitization or encoding, enabling an attacker to inject client-side scripts that execute in the victim's browser.
In CVE-2025-66376, the Zimbra Classic UI fails to properly sanitize CSS @import directives embedded in HTML email messages. An attacker can craft an email containing a malicious @import rule that, when rendered by the Classic UI, injects and executes arbitrary JavaScript in the victim's browser session. Because the payload is stored in the email message itself, it persists and executes every time the email is viewed, making this a stored XSS vulnerability with no user interaction beyond reading the email.
Learn more: CWE-79 — Cross-site Scripting (XSS)
Impact Analysis
CVE-2025-66376 carries a CVSS v3.1 base score of 7.2 (HIGH) with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The attack is network-accessible, requires low complexity, no privileges, and no user interaction. The Changed scope (S:C) indicates the vulnerability impacts resources beyond the Zimbra application itself, as injected scripts execute in the victim's browser context with access to the full origin.
Confidentiality (Low): The attacker can steal session cookies, authentication tokens, and access email content visible to the victim. While rated Low in the CVSS vector, the practical impact can be substantial when targeting administrative accounts or users with access to sensitive communications.
Integrity (Low): Injected scripts can modify the displayed email interface, forge email content, create filter rules, and perform actions on behalf of the victim. An attacker could silently forward all incoming email to an external address or modify email content in transit.
Availability (None): The vulnerability does not directly impact system availability, though persistent XSS payloads could degrade the user experience or be chained with other attacks.
The EPSS score of 28.8% is notably high, indicating significant real-world exploitation activity. Zimbra has historically been a high-value target for APT groups and espionage campaigns, as email servers contain highly sensitive organizational communications.
Exploit Maturity
CVE-2025-66376 demonstrates high exploit maturity with confirmed active exploitation. CISA added it to the Known Exploited Vulnerabilities catalog on March 18, 2026, with a remediation deadline of April 1, 2026. The EPSS score of 28.8% places it well above the exploitation threshold, indicating widespread targeting.
Zimbra XSS vulnerabilities have been repeatedly exploited by advanced persistent threat (APT) groups in targeted espionage campaigns. Previous Zimbra XSS vulnerabilities (such as CVE-2023-37580 and CVE-2024-11182) were weaponized by state-sponsored actors to steal email credentials and exfiltrate sensitive communications from government and diplomatic targets. CVE-2025-66376 follows the same pattern and is likely being used in similar targeted operations.
The exploitation technique is straightforward: an attacker sends a crafted HTML email to the victim. When the victim opens the email in the Zimbra Classic UI, the malicious CSS @import directive triggers script execution. No additional user interaction is required beyond viewing the email, making this an effective attack vector for spear-phishing campaigns.
Remediation
-
Update Zimbra Collaboration Suite immediately. Upgrade to ZCS 10.0.18 or later (for the 10.0 branch) or ZCS 10.1.13 or later (for the 10.1 branch). These versions contain the fix for the CSS @import sanitization bypass.
-
Switch users to the Modern UI. The vulnerability specifically affects the Zimbra Classic UI. If an immediate patch cannot be applied, migrating users to the Modern UI eliminates the attack vector as a temporary mitigation.
-
Implement email content filtering. Deploy email security gateways or content filters that strip or sanitize CSS @import directives from incoming HTML email before delivery to Zimbra. This provides defense-in-depth even after patching.
-
Review email accounts for indicators of compromise. Search for suspicious email filter rules, forwarding configurations, and application-specific passwords that may have been created through XSS exploitation. Pay special attention to administrative accounts and users handling sensitive communications.
-
Invalidate active sessions and rotate credentials. After patching, force re-authentication for all Zimbra users to invalidate any session tokens that may have been stolen through XSS exploitation. Require password changes for accounts that were actively using the Classic UI during the vulnerable period.
-
Deploy Content Security Policy (CSP) headers. Configure Zimbra's web server to send strict CSP headers that prevent inline script execution and restrict resource loading to trusted origins, providing an additional layer of defense against XSS attacks.
Technical Details
CVE-2025-66376 is a stored cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite affecting the Classic UI email rendering engine. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, yielding a score of 7.2. The vulnerability exists in the HTML email sanitizer's handling of CSS @import directives. When the Classic UI renders an HTML email message, it parses and applies embedded CSS styles. The sanitizer fails to adequately filter @import rules, which can be abused to load external stylesheets or, more critically, to inject JavaScript through CSS expression evaluation or by leveraging browser-specific CSS parsing behaviors. The attack requires no authentication because the attacker only needs to send an email to the target — the payload is stored in the email message and executes when the recipient views it in the Classic UI. The Changed scope (S:C) reflects that the injected script runs in the victim's browser, outside the Zimbra server component, with full access to the victim's session within the Zimbra origin. Affected versions are ZCS 10 before 10.0.18 and ZCS 10.1 before 10.1.13.
Frequently Asked Questions
Is CVE-2025-66376 being actively exploited?
Yes. CISA added CVE-2025-66376 to the Known Exploited Vulnerabilities catalog on March 18, 2026. Zimbra XSS vulnerabilities have historically been targeted by APT groups for email espionage campaigns, and this vulnerability follows the same pattern.
What products are affected by CVE-2025-66376?
Synacor Zimbra Collaboration Suite (ZCS) version 10 before 10.0.18 and version 10.1 before 10.1.13 are affected. The vulnerability is specific to the Classic UI; the Modern UI is not affected.
How do I fix CVE-2025-66376?
Upgrade to ZCS 10.0.18 or later (for the 10.0 branch) or ZCS 10.1.13 or later (for the 10.1 branch). As a temporary workaround, switch users from the Classic UI to the Modern UI.
How severe is CVE-2025-66376?
With a CVSS score of 7.2 (HIGH), an EPSS of 28.8%, and confirmed active exploitation, CVE-2025-66376 is a serious threat. Stored XSS in an email client enables credential theft, email exfiltration, and account takeover simply by having the victim open a malicious email.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.