CVE-2025-66376

HIGH

Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

CVSS v3.1 Score

7.2
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Published: 1/5/2026Modified: 6/17/2026

Related Intelligence (1)

CRITICALZero Day

Critical Zimbra security update fixes 9 vulnerabilities

Business email and collaboration suite Zimbra has received a major security update that fixes several critical issues that could allow attackers to execute malicious code on the server or in users’ browsers. Available in commercial and open-source editions, Zimbra Collaboration Suite is a self-hosted Microsoft Exchange alternative that is popular with businesses, government entities, and education

CVE-2025-27915CVE-2025-66376
CSO Online

References (6)

https://wiki.zimbra.com/wiki/Security_CenterRelease NotesVendor Advisoryhttps://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_FixesRelease Noteshttps://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_FixesRelease Noteshttps://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProducthttps://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376US Government Resource