CVE-2025-66376

Description

Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

Overview

State: PUBLISHED
Assigner (CNA): mitre
CVSS severity: HIGH
CVSS score: 7.2 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Effective score: 7.2 / 10 HIGH source: CNA overview
CWE(s): CWE-79
Reserved: 2025-11-28
Published: 2026-01-05 00:00 UTC
Last updated: 2026-03-19 03:55 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json
Linked Threat: CVE-2025-66376 — Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

CISA Known Exploited Vulnerabilities CISA KEV

CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.

Vulnerability name: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Vendor / project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Date added to KEV: 2026-03-18
Remediation due: 2026-04-01
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaign use: Unknown
CISA notes: https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2025-66376
CISA listing: www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-01-05 15:15:44 UTC
NVD last modified: 2026-03-18 20:13:37 UTC
NVD CVSS v3.1: 7.2 / 10 HIGH source: cve@mitre.org
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Exploitability subscore: 3.9 / 10
Impact subscore: 2.7 / 10
EPSS score: 0.1090 (probability of exploitation in next 30 days)
EPSS percentile: 93.49% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-0850
Assigner: mitre
Published: Jan 5, 2026, 12:00:00 AM
Updated: Mar 19, 2026, 3:55:17 AM
EUVD base score (CVSS 3.1): 7.2 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
EUVD-reported EPSS: 10.9000
Vendors: Zimbra
Products: Collaboration (10.1 <10.1.13)

Collaboration (10.0 <10.0.18)
Aliases: GHSA-h7wg-85fj-3c6g

ENISA description: Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

EUVD references (5)

Affected products (1)

Vendor	Product	Versions	Platforms
Zimbra	Collaboration	`10.0` (affected), `10.1` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

MITRE references (2) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (7)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-0850 rapid7:euvd.enisa.europa.eu
https://wiki.zimbra.com/wiki/Security_Center rapid7:wiki.zimbra.com
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy rapid7:wiki.zimbra.com
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories rapid7:wiki.zimbra.com
http://cwe.mitre.org/data/definitions/79.html rapid7:cwe.mitre.org
https://www.cve.org/CVERecord?id=CVE-2025-66376 rapid7:www.cve.org
https://attackerkb.com/topics/CVE-2025-66376 rapid7:attackerkb.com

NVD-tagged references (6)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://wiki.zimbra.com/wiki/Security_Center cve@mitre.org Release NotesVendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes cve@mitre.org Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes cve@mitre.org Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy cve@mitre.org Product
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories cve@mitre.org Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376 134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cwe	`CWE-79`	no local data	2026-05-14 02:58 UTC
cve	`CVE-2025-66376`	no local data	2026-05-14 02:58 UTC

Remediations (1)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CISA Required Action

CISA KEV

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-04-01 Known ransomware campaign use: Unknown

2026-05-14 01:13 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-66376.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66376",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-17T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-03-18",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T03:55:17.926Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-03-18T00:00:00.000Z",
            "value": "CVE-2025-66376 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Collaboration",
          "vendor": "Zimbra",
          "versions": [
            {
              "lessThan": "10.0.18",
              "status": "affected",
              "version": "10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "10.1.13",
              "status": "affected",
              "version": "10.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.18",
                  "versionStartIncluding": "10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.1.13",
                  "versionStartIncluding": "10.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T14:49:53.107Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"
        },
        {
          "url": "https://wiki.zimbra.com/wiki/Security_Center"
        },
        {
          "url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy"
        },
        {
          "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes"
        },
        {
          "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-66376",
    "datePublished": "2026-01-05T00:00:00.000Z",
    "dateReserved": "2025-11-28T00:00:00.000Z",
    "dateUpdated": "2026-03-19T03:55:17.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}