The Zimbra Zero-Day That Reads Your Mail Just by Being Opened — and Why Patching Isn't Enough

A patch closes a hole. It doesn’t close an account. That distinction is the entire story behind CVE-2025-66376, the Zimbra webmail flaw a Russian espionage crew rode for at least five months in 2025 to quietly siphon mailboxes, autofilled passwords, and 2FA scratch codes from Western governments — including US nuclear installations, according to Proofpoint. If your incident response playbook still ends at “apply the update,” this campaign is the reason it needs a second chapter.

How a View-Based XSS Turned Webmail Into an Exfiltration Kit

The joint NSA/CISA advisory published Thursday describes CVE-2025-66376 as “a view-based exploit that only requires a user to view a malicious email” in a vulnerable Zimbra Classic UI client. The bug is a stored cross-site scripting flaw where a crafted HTML email abuses CSS @import handling to run JavaScript inside an authenticated webmail session — the payload inherits whatever the user can do. NVD scored it 6.1 and says viewing counts as user interaction; MITRE scored it 7.2 and says it doesn’t; Unit 42 just calls it zero-click. All three agree the message runs when it renders.

The real problem: browser-rendered HTML email is a massive, under-scrutinized attack surface that every enterprise treats as “safe by default” because a sanitizer sits in front of it. Proofpoint’s writeup shows exactly how that assumption fails — the attackers used what Proofpoint calls tag-splitting, hiding an svg onload inside a display:none div, then fragmenting the tag with fake @import directives and HTML comments. Zimbra’s sanitizer strips the @import sequences and the leftover characters reassemble into <svg onload=eval(atob(...))>, which the browser happily executes.

If you run a SaaS product that renders any user-supplied HTML — support tickets, comment threads, in-app messaging — the tag-splitting technique is a template you should be testing against right now. Sanitizers that don’t parse the DOM the way the browser eventually will are the norm, not the exception. Expect the next twelve months of XSS advisories to look a lot like this one: not novel primitives, but adversarial abuse of how sanitizers and rendering engines disagree.

Why the Patch Doesn’t Undo the Damage

Zimbra shipped the fix in 10.1.13 on November 6, 2025, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on March 18, 2026. The problem is what Proofpoint tracks as ZimReaper — the JavaScript payload that runs on view. It steals the CSRF token, grabs the browser’s autofilled password, pulls 2FA scratch codes and Zimbra version details through the platform’s own APIs, and exfiltrates over DNS queries. Then it brute-forces the Global Address List two characters at a time and posts 90 days of the victim’s mail to the C2 as a TGZ archive.

Worse, the payload mints an app-specific password named ZimbraWeb via CreateAppSpecificPasswordRequest, which grants IMAP, POP3, or SMTP access without 2FA. In the January case Seqrite analyzed at a Ukrainian state hydrology agency, the payload also flipped zimbraPrefImapEnabled to TRUE. As Seqrite’s researchers put it bluntly: “App-specific passwords survive password resets.” A team that patched in November but never audited audit logs is still owned in July.

Imagine you’re the SecOps lead at a NATO defense contractor running Zimbra 10.1.10. You apply 10.1.13 the day the CVE lands, close the ticket, and move on. Six months later, an adversary is still pulling mail over IMAP with a credential your patch never touched. Review /opt/zimbra/log/audit.log for CreateAppSpecificPassword calls, kill anything named ZimbraWeb, hunt accounts with zimbraPrefImapEnabled set unexpectedly, and alert on SOAP calls to GetScratchCodesRequest — which should be near-zero in normal traffic.

The editorial take: the industry’s obsession with patch SLAs has trained us to conflate “patched” with “remediated.” They are not the same word, and this campaign is going to force that lesson into more compliance frameworks.

What the Targeting List Really Tells Us

Unit 42 counted at least nine C2 IP addresses and nine domains, with each server live an average of 35.4 days. Neither Unit 42 nor Proofpoint named specific victims, but the sector list is stark: government, defense, transportation, and financial organizations across NATO member states, Ukraine, the Commonwealth of Independent States, and Africa. Proofpoint added US government, scientific, and defense industrial base entities — including nuclear installations — to the list.

What this means for anyone running self-hosted collaboration software: end-of-life dates are attack timelines. Zimbra 10.0 reached end of life on December 31, 2025, and 10.0.18 is an emergency floor rather than a destination. The newest 10.1 release, 10.1.20 from July 20, patches four more stored XSS flaws in the same Classic Web Client. If your organization stores regulated data in on-prem webmail — think a hospital IT team managing physician communications where healthcare workflows and compliance obligations intersect, or a logistics operator whose mailboxes carry customs paperwork tied to supply chain traceability systems — the calculus of self-hosting versus managed webmail just shifted.

Prediction: expect a wave of mid-market organizations to abandon self-hosted Zimbra entirely over the next 12 months, either for Microsoft 365 or for hardened managed hosts. The operational burden of “patch, then audit every account for persistence artifacts” is not something a two-person IT team can absorb repeatedly.

The Attribution Fog and What It Doesn’t Change

The advisory lists LAUNDRY BEAR, Void Blizzard, CL-STA-1114, and TA488 as names in community use for the actors behind this activity, while warning the mapping may not be one-to-one. The Hacker News compared indicator lists and found the same nine domains in both Unit 42’s and Proofpoint’s reports. Seqrite attributed its January case to APT28 with medium confidence; Dutch intelligence treats LAUNDRY BEAR and APT28 as separate actors. Proofpoint said it hasn’t seen TA488 activity since February 2026, tying the silence to Seqrite’s disclosure. Unit 42 says targeting of unpatched instances continues.

For defenders, the naming argument is noise. The technique — view-based XSS delivering a credential-harvesting payload that establishes persistence outside the primary auth flow — is now public and reproducible. Other actors will copy the pattern against other webmail platforms. The CreateAppSpecificPassword persistence trick, in particular, is portable to any service that offers legacy protocol bypasses for 2FA.

FAQ

Q: What is CVE-2025-66376? A: A stored cross-site scripting vulnerability in Zimbra Collaboration’s Classic UI, affecting versions 10.0 before 10.0.18 and 10.1 before 10.1.13. A crafted HTML email using tag-splitting and fake @import directives bypasses the sanitizer and executes JavaScript when the message is viewed, giving attackers the authenticated user’s mailbox access.

Q: Does patching Zimbra to 10.1.13 or later fully remediate a compromise? A: No. The patch stops the initial JavaScript execution, but the ZimReaper payload creates app-specific passwords (named ZimbraWeb), enables IMAP, and exfiltrates 2FA scratch codes. These persistence mechanisms survive password resets. Full remediation requires auditing /opt/zimbra/log/audit.log, removing rogue app-specific passwords, resetting scratch codes, and reviewing zimbraPrefImapEnabled settings.

Q: Who is behind the campaign? A: The NSA/CISA advisory lists LAUNDRY BEAR, Void Blizzard, CL-STA-1114 (Palo Alto Unit 42), and TA488 (Proofpoint) as community names for the actors, noting the mapping is imperfect. Seqrite attributed a January 2026 case at a Ukrainian hydrology agency to APT28 with medium confidence. All are assessed as Russian state-sponsored.

Key Takeaways

• Treat “patched” and “remediated” as separate states in your incident response playbook — for any credential-stealing payload, remediation always includes account-level artifact hunting.
• HTML sanitizers that don’t parse markup the way browsers eventually render it will keep failing; add tag-splitting and CSS @import abuse to your XSS test suites now.
• App-specific password mechanisms designed for legacy protocol compatibility are a persistence goldmine for adversaries — audit any service in your stack that offers them, and alert on programmatic creation.
• Organizations running end-of-life collaboration software should assume they’re on a countdown, not a support gap; Zimbra 10.0 hitting EOL on December 31, 2025 makes the migration urgency operational, not administrative.
• Attribution disputes between vendors and intelligence services rarely change defensive priorities — chase the technique and the indicators, not the codename.