CISA KEV: Zimbra Collaboration XSS Vulnerability CVE-2025-66376
Summary
CISA has added a known exploited vulnerability, CVE-2025-66376, affecting Zimbra Collaboration. This cross-site scripting (XSS) vulnerability requires immediate attention from federal agencies and organizations using the affected software.
What changed
CISA has added CVE-2025-66376, a stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration (ZCS) versions prior to 10.0.18 and 10.1.13, to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, rated HIGH with a CVSS score of 7.2, allows for XSS attacks via Cascading Style Sheets (CSS) @import directives in HTML emails.
Federal agencies are mandated to patch or mitigate this vulnerability by March 18, 2026. Other organizations using Zimbra Collaboration should prioritize patching to the latest versions to protect against active exploitation. Failure to address this vulnerability could lead to unauthorized access, data compromise, and further system compromise.
What to do next
- Apply security updates to Zimbra Collaboration versions 10.0 and 10.1 to address CVE-2025-66376.
- Verify that all affected Zimbra Collaboration instances are patched or mitigated.
- Review security logs for any signs of exploitation related to this vulnerability.
Source document (simplified)
Required CVE Record Information
CNA: MITRE Corporation
Description
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CWE 1 Total
Learn more
- CWE-79: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CVSS 1 Total
Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 7.2 | HIGH | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Product Status
Learn more Versions 2 Total
Default Status: unaffected
affected
affected from 10.0 before 10.0.18
affected from 10.1 before 10.1.13
References 5 Total
- https://wiki.zimbra.com/wiki/ZimbraSecurityAdvisories
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/ZimbraResponsibleDisclosure_Policy
- https://wiki.zimbra.com/wiki/ZimbraReleases/10.1.13#SecurityFixes
- https://wiki.zimbra.com/wiki/ZimbraReleases/10.0.18#SecurityFixes
Authorized Data Publishers
CISA-ADP
Updated:
2026-03-19
SSVC and KEV, plus CVSS and CWE if not provided by the CNA.
SSVC 1 Total
Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | no | partial | 2.0.3 | 2026-03-17 |
KEV 1 Total
Learn more
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376 (2026-03-18)
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Data Privacy & Cybersecurity alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when CISA Known Exploited Vulnerabilities (KEV) publishes new changes.