Zimbra Collaboration

CVE-2025-66376 is a stored XSS in Zimbra Collaboration Suite's Classic Web UI caused by insufficient sanitization of CSS @import directives inside HTML email bodies. Attackers wrap a Base64 payload inside an SVG onload handler and fragment the surrounding markup with fake @import directives, split tags, and HTML comments so Zimbra's sanitizer misses it — but the victim's browser reassembles it into live JavaScript that runs the moment the message renders. Affected builds are ZCS 10.0.x < 10.0.18 and ZCS 10.1.x < 10.1.13; fixes shipped in November 2025.

Zimbra rated this HIGH (7.2) with a Scope:Changed, Confidentiality:Low, Integrity:Low vector — a textbook stored-XSS math result. That math is wrong for this bug. It is *zero-click*, executes in the victim's authenticated webmail origin, and has been used by Russia's Laundry Bear / Void Blizzard / TA488 to exfiltrate 90 days of mail, hijack sessions, and steal 2FA codes from government targets. CISA added it to KEV and issued a joint advisory (AA26-204A). Real-world impact is full mailbox compromise without user interaction — that is CRITICAL, not HIGH.

Why this verdict

• Zero-click, no privileges: the CVSS vector itself reports PR:N/UI:N — the attacker only needs an SMTP path to the recipient. No friction filter removes anyone from the reachable population.
• Active nation-state exploitation: Laundry Bear / TA488 is currently burning this against NATO and Ukrainian government mail. KEV + FVEY joint advisory removes any 'theoretical' discount.
• Role multiplier — enterprise webmail is an identity-adjacent, high-value role: the compromised origin can read all mail including MFA OTPs, password-reset links, and executive correspondence, and can set persistent forwarding filters. Chain outcome per victim = full mailbox takeover; per organization = SSO / SaaS pivot via harvested resets. Zimbra installs are canonically in this role → floor is CRITICAL.
• Vendor C:L / I:L is misleading: stored XSS scoring conventions underweight the fact that the vulnerable origin *is* the crown-jewel data store. There is no scope-changed pivot needed to reach the sensitive data — it is already in the same origin.

Why not higher?

No higher bucket exists above CRITICAL in this schema. Reassessed 9.3 rather than 10.0 because impact is scoped to the individual mailbox origin per exploit (attacker must land a message per target account for full effect) and does not directly yield RCE on the Zimbra host itself.

Why not lower?

Downgrading to HIGH would require ignoring the KEV listing, the zero-click vector, and the ongoing FVEY-attributed campaign. The bug requires no authentication, no interaction, and hits a component whose whole purpose is to hold the organization's most sensitive written communication — every friction argument for a downgrade fails.

1. Patch to ZCS 10.0.18 or 10.1.13 now — This is the only durable fix. Given CRITICAL + active exploitation, the KEV-override applies: mitigate/patch within hours, not the standard 3-day noisgate mitigation SLA. Schedule the maintenance window today.
2. Switch users off Classic UI to Modern UI as an interim — The reported exploitation path targets Classic UI rendering. Setting zimbraPrefClientType=advanced (Modern) organization-wide reduces exposure while patching rolls out. Not a substitute for the patch.
3. Strip SVG and CSS @import at the mail gateway — Add Proofpoint/Mimecast/Rspamd rules to drop or neutralize inbound HTML containing <svg with event handlers and @import in style blocks from external senders. Deploy within 24 hours as belt-and-braces.
4. Hunt for TA488 IOCs and unauthorized mail filters — Pull the CISA AA26-204A IOC list. Run zmprov gaf across all accounts to enumerate mail filters and forwarding rules; alert on any external-forward or silent-copy rule created since November 2025. Complete within 72 hours.
5. Force session invalidation and password rotation post-patch — If any host ran a vulnerable build after November 2025, assume mailbox compromise. Rotate credentials, revoke OAuth tokens, invalidate active sessions (zmprov -l flushCache), and rotate any secrets/2FA seeds that transited email.

Run this on each Zimbra mailbox server as the zimbra user (e.g. sudo -u zimbra bash check-cve-2025-66376.sh). It reads zmcontrol -v to get the installed ZCS version and compares against the fixed builds. No network calls; no elevated privileges beyond the zimbra service account.

#!/usr/bin/env bash
# noisgate verification for CVE-2025-66376 (Zimbra Collaboration XSS)
# Run as the 'zimbra' service account on each ZCS mailbox host.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -u

ZMCONTROL="$(command -v zmcontrol || echo /opt/zimbra/bin/zmcontrol)"
if [ ! -x "$ZMCONTROL" ]; then
  echo "UNKNOWN: zmcontrol not found — is this a Zimbra host?"
  exit 2
fi

RAW="$($ZMCONTROL -v 2>/dev/null)"
# Example: 'Release 10.1.9_GA_4870.RHEL9_64_20250715120000 RHEL9_64 FOSS edition, Patch 10.1.9_P1.'
VER="$(echo "$RAW" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"

if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse ZCS version from: $RAW"
  exit 2
fi

IFS='.' read -r MAJ MIN PAT <<< "$VER"

echo "Detected ZCS version: $VER"

# Fixed: 10.0.18 (10.0.x branch) and 10.1.13 (10.1.x branch)
if [ "$MAJ" -eq 10 ] && [ "$MIN" -eq 0 ]; then
  if [ "$PAT" -ge 18 ]; then
    echo "PATCHED: 10.0.$PAT >= 10.0.18"; exit 0
  else
    echo "VULNERABLE: 10.0.$PAT < 10.0.18 (CVE-2025-66376)"; exit 1
  fi
elif [ "$MAJ" -eq 10 ] && [ "$MIN" -eq 1 ]; then
  if [ "$PAT" -ge 13 ]; then
    echo "PATCHED: 10.1.$PAT >= 10.1.13"; exit 0
  else
    echo "VULNERABLE: 10.1.$PAT < 10.1.13 (CVE-2025-66376)"; exit 1
  fi
elif [ "$MAJ" -lt 10 ]; then
  echo "VULNERABLE: ZCS $VER is EoL and does not receive this fix — treat as vulnerable and plan upgrade"; exit 1
else
  echo "UNKNOWN: unrecognized branch $MAJ.$MIN — verify against Zimbra Security Center"; exit 2
fi

Sources

1. CISA Joint Advisory AA26-204A
2. US DoD Cybersecurity Advisory PDF
3. BleepingComputer — CISA orders feds to patch Zimbra XSS
4. BleepingComputer — Russian hackers exploit Zimbra zero-click flaw
5. The Hacker News — Laundry Bear Zimbra 0-day
6. eSecurityPlanet — TA488 technical writeup
7. Zimbra Security Center
8. SecurityAffairs — Laundry Bear campaign