CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability. Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.

• CISA KEV-listed (remediation due 2026-04-01)
• EPSS 19.6% (97.2% percentile)
• CVSS 7.2 high

Related briefings

• Russian hackers steal Western emails with a zero-click Zimbra exploit 2026-07-25

Linked threat actors

• Laundry Bear machine-inferred link

Browse the CVE database

Read the full analysis on IntelFusions