Zimbra CVE-2025-66376: a mail espionage campaign

On 23 July 2026 a joint advisory (involving the NSA and CISA and partners) detailed a cyber-espionage campaign that abused CVE-2025-66376 in Zimbra Collaboration mail software. It is a good moment to separate two things: the flaw itself (old and patched) and the new knowledge of how long — and against whom — it was used.

What the flaw is

CVE-2025-66376 is a stored XSS in Zimbra’s Classic UI. A crafted HTML email abuses the handling of the CSS @import directive to execute JavaScript in the context of the victim’s authenticated webmail session. When a user simply opens such a message in the Classic UI, the injected script already runs with their privileges.

The affected versions are Zimbra Collaboration 10.0 before 10.0.18 and 10.1 before 10.1.13. The vendor released fixes on 6 November 2025. According to the advisory, the flaw was exploited as a zero-day for roughly five months in 2025 before it was patched.

What was actually stolen

The advisory describes how the script, running in the victim’s session, could exfiltrate a highly sensitive set of data:

• the last 90 days of email,
• the organisation’s complete email directory,
• browser-saved passwords,
• 2FA recovery codes.

That last point matters: stealing two-factor recovery codes means patching the server does not end the story. If someone exfiltrated that data during the exposure window, access can survive the update — which is why post-incident you must rotate credentials and revoke 2FA methods.

Who it targeted

According to the advisory, the targets were government, defence, transport and financial organisations across NATO members, Ukraine, the Commonwealth of Independent States, Africa and the US — including scientific and defence-industrial-base entities, and nuclear installations. This is the profile of a classic espionage operation aimed at intelligence collection, not extortion.

Handle attribution carefully

Precision is required here, because sources do not fully agree. Proofpoint tracks the actor as TA488. The joint advisory lists the names LAUNDRY BEAR, Void Blizzard, CL-STA-1114 and TA488, with an explicit caveat that the mapping may not be one-to-one. Unit 42 classifies the activity as CL-STA-1114. Dutch intelligence treats LAUNDRY BEAR and APT28 as separate groups, and Seqrite attributed a related January case to APT28 “with medium confidence.”

The takeaway is simple: this is a Russia-linked campaign, but the specific group labels overlap and are sometimes contested. An honest write-up states that fact rather than picking a single name for effect. We discussed a similar attribution problem in the phishing attack on Signal backup keys.

What to do

1. Update Zimbra to at least 10.0.18 / 10.1.13 if you have not already. The fix is from November 2025 — not applying it means many months of exposure.
2. Assume compromise within the exposure window. If the server went unpatched after November 2025, review webmail logs for unusual sessions and bulk mail retrieval.
3. Rotate credentials and 2FA. Since passwords and recovery codes were stolen, reset the passwords of accounts that may have been exposed and revoke and re-enrol 2FA methods. Consider phishing-resistant MFA.
4. Warn users about HTML email. The vector was merely opening a message — it is worth reinforcing caution and considering rendering restrictions in the Classic UI.
5. Treat mail as critical infrastructure. A mail server is a trove of data and an entry point to the rest of the organisation; it needs short patch windows and monitoring.

The bottom line

CVE-2025-66376 is a reminder that “patched in November” does not mean “safe” if someone exfiltrated passwords and 2FA codes in the meantime. Updating is necessary, but responding to this campaign also requires credential rotation. If you want to check what your organisation actually exposes in mail and how quickly it would detect such access, get in touch.

---

Sources: The Hacker News, BleepingComputer, Tenable — CVE-2025-66376, CISA KEV.