CVE-2025-66376

This flaw lets an attacker hide malicious instructions inside an email so that when a Zimbra webmail user opens that message, the attacker’s code runs inside the user’s browser. Think of it like a fake “receipt” email that looks normal, but when opened, it quietly steals login/session information and other sensitive data stored in the browser and mailbox.

This matters if you run Zimbra Collaboration Suite (ZCS) “Classic UI” webmail and users can access it through a browser. It’s relevant even if you don’t think of yourself as a high-profile target—real attackers have used this in campaigns against organizations. Because this is triggered when a victim views the crafted email, the risk is mainly: if your users receive and open malicious emails in a Zimbra Classic UI environment.

This is a RED issue because it has confirmed real-world exploitation, and Zimbra webmail can be abused to execute attacker code inside a user’s browser when they view a crafted email. Attackers used it to steal credentials, session information, 2FA codes, and access mailbox contents, so the impact can be direct and immediate.