PT-2026-1290 · Zimbra · Zimbra Collaboration

CVE-2025-66376 · Published 2026-01-05 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions prior to 10.0.18 Zimbra Collaboration (ZCS) versions prior to 10.1.13

Description The software contains a stored cross-site scripting (XSS) issue within the Classic UI. This occurs due to Cascading Style Sheets (CSS) @import directives in an HTML email message. The issue allows for malicious code execution when a user views a crafted email.

Recommendations Update to Zimbra Collaboration (ZCS) version 10.0.18 or later. Update to Zimbra Collaboration (ZCS) version 10.1.13 or later.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-01010

CVE-2025-66376

Affected Products

Zimbra Collaboration

References · 59

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66376.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66376 · Security Note
• https://bdu.fstec.ru/vul/2026-01010 · Security Note
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66376 · Vendor Advisory
• https://twitter.com/threadlinqs/status/2035539998271738077 · Twitter Post
• https://twitter.com/ThreatSynop/status/2034454750377246941 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1rxlpmq/cisa_issues_warning_new_exploited_vulnerability · Reddit Post
• https://twitter.com/DeusLogica/status/2035164254290973166 · Twitter Post
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes · Note
• https://twitter.com/VivekIntel/status/2034114447661556035 · Twitter Post
• https://twitter.com/twelvesec/status/2035929282216620535 · Twitter Post
• https://twitter.com/CISACyber/status/2034328825304174704 · Twitter Post
• https://reddit.com/r/TechNadu/comments/1ry2zj9/cisa_adds_actively_exploited_zimbra_vulnerability · Reddit Post
• https://t.me/CVEtracker/41385 · Telegram Post