Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

MEDIUM 6.1EXPLOITED (CISA KEV)CVE-2025-66376 · Published 05/01/2026 · updated 07/10/2026

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 18/03/2026. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
zimbra collaboration suite synacor	`≥ 10.0.0, < 10.0.18≥ 10.1.0, < 10.1.13`	`10.0.1810.1.13`

Description

Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

References

wiki.zimbra.com/wiki/Security_Center · Release Notes
wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18 · Release Notes
wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13 · Release Notes
wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Product
wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2025-66376

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free