nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-66376 CVE-2025-66376
HIGHCISA KEV
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Record summary
CVE-2025-66376 has a selected CVSS score of 7.2 (high). CISA lists CVE-2025-66376 in KEV.
Description
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
Description source: CVE List
Exploitation context
Known exploitation
- CISA KEV
- Listed · Mar 18, 2026 · CISA
- VulnCheck KEV
- Listed · Mar 17, 2026 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
CISA SSVC decision
ExploitationActive
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 17, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Zimbra Collaboration Suite (ZCS)Browse Synacor / Zimbra Collaboration Suite (ZCS) | CISA | Version data not supplied | |
CollaborationBrowse Zimbra / CollaborationDefault status: unaffected | CVE List | 10.0 to < 10.0.18 | affected |
| 10.1 to < 10.1.13 | affected | ||
References
7wiki.zimbra.com
https://wiki.zimbra.com/wiki/Security_Center wiki.zimbra.com
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18 wiki.zimbra.com
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13 wiki.zimbra.com
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy wiki.zimbra.com
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories cisa.govGovernment resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376