cve recordhighexploited in the wild

CVE-2025-66376

Synacor · Zimbra Collaboration Suite (ZCS) · Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

· Added to CISA KEV Mar 18, 2026

CVSS—

Severityhigh

Weakness—

ExploitedYes, in CISA KEV

Ransomware useUnknown

Federal fix dueApr 1, 2026

Description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.

Required action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

← Back to the CVE Tracker

Our coverage of CVE-2025-66376

CVE-2026-73570Aug 20, 2026critical

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

Attackers are actively exploiting a critical vulnerability in Zimbra Collaboration (ZCS) that allows for unauthenticated remote code execution. The flaw, identified as CVE-2026-73570 with a CVSS score of 8.9, stems from improper input sanitization in the SNMP notification processing. Exploitation can lead to the execution of arbitrary operating system commands as the Zimbra user. Zimbra has released version 10.1.20 to patch this vulnerability, and CERT Polska is urging users to check their logs for signs of compromise.

CVE-2008-4128Aug 7, 2026high

July 2026 CVE Landscape

In July 2026, a significant increase in high-impact vulnerabilities was observed, with 85 critical flaws identified, 36 of which had a Very Critical Recorded Future Risk Score. A notable portion of these vulnerabilities were either already listed in CISA's Known Exploited Vulnerabilities catalog or were reported by vendors. The vulnerabilities affected a wide range of products from 61 vendors, with Microsoft products being the most frequently impacted.

CVE-2025-66376Jul 23, 2026high

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A sophisticated Russian espionage campaign, attributed to the group TA488 (also known as LAUNDRY BEAR or Void Blizzard), has been actively exploiting a zero-day vulnerability in Zimbra Collaboration's webmail client since at least July 2025. This flaw allowed attackers to steal sensitive data, including emails, contact lists, browser-saved passwords, and two-factor authentication codes, by simply having a user view a specially crafted HTML email. The vulnerability, identified as CVE-2025-66376, was patched by Zimbra in November 2025, but the attackers continued to leverage it for months prior to the fix.