VulnerabilityALERT High

CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.

Impact

CISA lists CVE-2025-66376 as known exploited in the wild for Synacor Zimbra Collaboration Suite (ZCS). Ransomware campaign use: Unknown. Federal remediation due date: 2026-04-01.

Recommended Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Published: 3/18/2026, 12:00:00 AMSource: CISA Known Exploited Vulnerabilities CatalogTags: CVE-2025-66376, Synacor, Zimbra Collaboration Suite (ZCS), CISA KEV, CWE-79