CVE-2025-66376

What it actually does

CVE-2025-66376 is a stored cross-site scripting flaw in the Zimbra Collaboration Classic UI. A remote unauthenticated attacker can send a crafted HTML email containing Cascading Style Sheets @import directives that are not sufficiently sanitized by affected Zimbra versions. When the message is rendered in the Classic UI, attacker-controlled content can execute in the victim user's authenticated webmail browser context. This can allow reading or modifying mailbox data accessible to the user, performing webmail actions as the user, stealing sensitive message content, abusing authenticated sessions, or pivoting to additional Zimbra functionality exposed through the web client.

Why it matters to the business

Successful exploitation can compromise email confidentiality and integrity without requiring the attacker to have an account on the mail platform. Because email often contains credentials, reset links, contracts, legal communications, and operational data, exploitation can lead to data theft, impersonation, business email compromise, fraud, and follow-on intrusion. This issue is listed in CISA KEV with a remediation due date of 2026-04-01 and is marked as actively exploited in the wild, so exposed Zimbra deployments should be treated as a priority even though the flaw is not known to be ransomware-specific.

How an attack unfolds

An attacker crafts an HTML email that embeds malicious CSS @import content designed to bypass Zimbra Classic UI filtering. The attacker sends the message to one or more users on an affected Zimbra Collaboration deployment. The message is stored in the target mailbox, making the payload persistent until deleted or sanitized. When a user views the email in the Classic UI, the web client processes the malicious content in the authenticated browser session. The attacker-controlled code or content can then interact with the webmail application as that user, potentially reading email content, sending messages, changing account settings, creating mail filters or forwarding behavior, or exfiltrating information to attacker-controlled infrastructure. In active exploitation scenarios, the initial XSS may be used to harvest sensitive email data, enable persistence through mailbox rules, and support further phishing or account takeover activity.

How to fix it

Upgrade Zimbra Collaboration to a fixed release immediately: upgrade ZCS 10.0.x to 10.0.18 or later, and upgrade ZCS 10.1.x to 10.1.13 or later. If immediate upgrade is not possible, reduce exposure by disabling or restricting the Classic UI where operationally feasible, enforcing HTML email sanitization at mail gateways, blocking or rewriting remote CSS imports in inbound HTML email, and limiting webmail access to trusted networks or VPN until patched. Review and harden mailbox settings that attackers commonly abuse after XSS, including mail forwarding, filters, delegated access, and application-specific tokens. Because this issue is in KEV and actively exploited, mitigation should be considered temporary; patching to a fixed version is the primary remediation.

How to confirm the fix worked

Confirm the installed Zimbra Collaboration version is no longer affected: ZCS 10.0.x must be 10.0.18 or later, and ZCS 10.1.x must be 10.1.13 or later. Validate that the Classic UI no longer renders or executes crafted HTML email content containing CSS @import directives. Test using a benign proof-of-concept message in a non-production mailbox and confirm the directive is removed, neutralized, or rendered inert. Verify mail gateway controls detect or rewrite inbound HTML messages containing style blocks, CSS imports, or remote stylesheet references. Confirm no unexpected mailbox forwarding rules, filters, delegated access settings, or suspicious active sessions remain after remediation.

Typical attack path

1. Identify an organization using an affected Zimbra Collaboration version with Classic UI available.
2. Craft an HTML email containing malicious CSS @import directives that trigger stored XSS when rendered.
3. Send the crafted message to targeted Zimbra users or distribution lists.
4. Wait for the message to be opened or rendered in the Classic UI.
5. Execute attacker-controlled actions in the victim user's authenticated webmail context.
6. Exfiltrate mailbox data, alter settings, create forwarding/filter rules, send internal phishing, or abuse the compromised session for follow-on access.
7. Remove or hide obvious artifacts where possible, such as deleting sent messages or relying on remote attacker-controlled resources that can be changed after delivery.

How to detect it

Investigate whether crafted HTML messages were delivered to users before patching. Prioritize Zimbra mailbox logs, audit logs, web access logs, mail gateway logs, MTA logs, and endpoint/browser telemetry. Search inbound email bodies, quarantine stores, and message archives for CSS @import directives inside HTML email, particularly messages from external senders that were delivered to users who use the Classic UI. In Zimbra logs, correlate suspicious message delivery times with webmail access, unusual session activity, new mailbox rules, forwarding changes, sent messages, delegated access changes, or account setting changes. Review proxy or DNS logs for user browsers making outbound requests to unfamiliar domains shortly after opening webmail; malicious CSS imports may cause external stylesheet fetches or related exfiltration traffic. Look for post-exploitation behavior rather than only the email payload: unexpected forwarding addresses, new filters that hide or redirect mail, abnormal sent mail, unusual authentication source IPs, mailbox exports, and repeated access to sensitive messages. If suspicious messages are found, preserve full headers, raw MIME content, URLs/domains referenced by @import, recipient lists, and corresponding Zimbra audit/access logs.

• @import
• <style>@import
• <style type="text/css">@import
• style="@import
• @import url(
• @import "http://
• @import 'http://
• @import "https://
• @import 'https://
• text/css
• /opt/zimbra/log/mailbox.log
• /opt/zimbra/log/audit.log
• /opt/zimbra/log/nginx.access.log
• /opt/zimbra/log/access_log
• /opt/zimbra/store/
• zimbraPrefMailForwardingAddress
• zimbraMailForwardingAddress
• AddMsg
• ModifyPrefsRequest
• CreateFilterRuleRequest
• GetMsgRequest
• SendMsgRequest

What your security team should do

• Patch affected Zimbra Collaboration servers to 10.0.18+, 10.1.13+, or a later vendor-supported release as the highest-priority action.
• Treat unpatched internet-accessible Zimbra Classic UI deployments as high risk due to active exploitation and KEV status; meet or beat the 2026-04-01 CISA deadline where applicable.
• Search mail stores and gateway logs for inbound HTML email containing CSS @import directives, especially from external senders to privileged users.
• Review Zimbra mailbox audit logs for suspicious account activity after suspect messages were delivered or opened, including new filters, forwarding rules, delegated access, sent mail, and unusual login sessions.
• Temporarily restrict or disable Classic UI access if patching cannot be completed immediately.
• Add mail security controls to block or sanitize remote stylesheet imports and active content in HTML email.
• Hunt for outbound browser connections to suspicious domains immediately after users viewed webmail messages.
• Force reauthentication and revoke suspicious sessions or tokens for accounts that viewed malicious messages or show abnormal mailbox changes.
• Preserve suspicious email samples, mailbox logs, access logs, and audit logs before cleanup to support incident response.