CVE-2025-66376
Medium 6.1 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
Metrics
- CVSS 3.1
-
6.1 (MEDIUM)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 20% (percentile: 97) as of 1 November 2026
- CWE
- CWE-79
Affected products
synacor: zimbra collaboration suite
References
- https://wiki.zimbra.com/wiki/Security_Center Release NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy Product
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025… US Government Resource