CVE-2025-66376: Zimbra Collaboration Classic UI stored XSS via CSS @import in email

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is a network-reachable stored XSS with a scope change and confirmed inclusion in CISA KEV, though its CVSS base score is only 6.1 and it requires victim interaction.

What it is

Zimbra Collaboration Suite 10 before 10.0.18 and 10.1 before 10.1.13 allows stored cross-site scripting in the Classic UI through CSS @import directives embedded in an HTML email message. Because the payload is stored in a delivered message, it can execute in the browser of any user who views it, and the record does not state whether the flaw is limited to the Classic UI or affects other clients.

Impact

An attacker can run script in the context of a victim's Zimbra web session, enabling session or credential theft and actions performed as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network by sending an HTML email containing a crafted CSS @import directive; no authentication is required to deliver the message, but the victim must open or view it in the Classic UI (UI:R).

Exploitation

CVE-2025-66376 was added to CISA KEV on 2026-03-18 with a remediation due date of 2026-04-01, indicating known exploitation; EPSS gives a 30-day probability of 0.19559 (97.2nd percentile). No ransomware campaign use is documented.

What to do

• Upgrade Zimbra Collaboration to 10.0.18 or 10.1.13 (or later) per the vendor release notes.
• If immediate patching is not possible, apply the mitigations in the vendor Security Center guidance or discontinue use of the affected Classic UI, consistent with CISA's required action.
• Restrict or filter inbound HTML email containing CSS @import directives at the mail gateway where operationally feasible.
• Limit use of the Classic UI in favor of a client not affected by this issue until systems are patched.
• Track CISA KEV remediation deadlines for internet-facing Zimbra instances.

Detection

• Search mail logs and message stores for inbound HTML messages containing CSS @import directives.
• Monitor web proxy and Zimbra access logs for anomalous script or external resource loads originating from webmail sessions.
• Review Zimbra webmail sessions for unexpected session activity or credential use following message viewing.
• Audit deployed Zimbra versions against the fixed 10.0.18 and 10.1.13 releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.