Dashboard / CVE-2025-66376

CVE-2025-66376

CISA KEV
ACT NOW Priority: 0.00 BB Relevance: 4/100
Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.

CISA Known Exploited Vulnerability

Vendor / Product Synacor — Zimbra Collaboration Suite (ZCS)
Date Added 2026-03-18
Remediation Due 2026-04-01
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2025-66376

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
synacor zimbra_collaboration_suite 10.0.0 – 10.0.18
synacor zimbra_collaboration_suite 10.1.0 – 10.1.13

References & Advisories (6)

https://wiki.zimbra.com/wiki/Security_Center
Release Notes Vendor Advisory

Bug Bounty Relevance

4 / 100
✓ Known exploited (KEV)

CVSS Score

Unscored

EPSS — Exploitation Probability

20.23%
Raw Score 0.202270
Percentile 97.5%
Date 2026-10-28

Intelligence Sources

kev ref →

External Links