Back Scworld

Updated CISA exploited flaws list adds SharePoint, Zimbra bugs | brief

Scworld • March 19, 2026

The Cybersecurity and Infrastructure Security Agency has updated its Known Exploited Vulnerabilities list to include high-severity flaws impacting Microsoft SharePoint and the Synacor Zimbra Collaboration Suite, Security Affairs reports.

"In a network-based attack, an unauthenticated attacker could write arbitrary code to inject and execute code remotely on the SharePoint Server," according to the CISA advisory. On the other hand, the stored cross-site scripting flaw in Zimbra's Classic UI, tracked as CVE-2025-66376, may allow attackers to exploit CSS @import directives within email HTML.

Federal agencies have been ordered by CISA to remediate CVE-2026-20963 and CVE-2025-66376 by Mar. 21 and Apr. 1, respectively. Meanwhile, private companies are also urged to assess the catalog and fix both vulnerabilities.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine Russian state-backed hackers from APT28 are actively exploiting a high-severity stored cross-site scripting vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite (ZCS) to target Ukrainian government entities. The flaw allows unauthenticated attackers to execute remote code and harvest sensitive information from compromised email accounts. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and mandated that U.S. federal agencies secure their servers by April 1, 2026. The attacks involve phishing emails containing obfuscated JavaScript payloads that exploit the vulnerability when opened in a vulnerable Zimbra session. This campaign, named Operation GhostMail, has already targeted critical infrastructure, including the Ukrainian State Hydrology Agency. Security researchers have noted that Zimbra vulnerabilities have been frequently exploited in recent years, with multiple incidents reported involving state-sponsored actors. Organizations using Zimbra are urged to apply the available patches immediately to mitigate risks. 8 sources 81

Extracted Entities

Updated CISA exploited flaws list adds SharePoint, Zimbra bugs | brief

The full story

Extracted Entities

Companies (2)

CVEs (2)

MITRE ATT&CK (1)

Platforms (2)

Vulnerabilities (1)