Medium
KEV-listed
CVE-2025-66376
Phishing Campaign Exploiting Zimbra Collaboration Suite Vulnerability CVE-2025-66376
Vendor / product: Zimbra Collaboration Suite
Event date: 2026-07-23
Victim organization: Governments and critical sectors
Public PoC: Yes
First tracked by RiskWire: 2026-08-28
CISA KEV catalog
Added to KEV
Federal remediation due
2026-04-01 (172 days overdue)
Ransomware campaign use
Unknown
CISA description
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Named threat actors
Laundry Bear
Sources & citations (3)
- Azerbaijan's National Cybersecurity Agency warns Zimbra users of threats report.az · 2026-08-28
- Azerbaijan warns Zimbra users of targeted cyber threats caliber.az · 2026-08-28
- Национальное агентство кибербезопасности предупредило пользователей Zimbra об угрозах report.az · 2026-08-28
References
See CVE-2025-66376 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →