Zimbra urges customers to patch critical web client XSS flaw

Bleepingcomputer

Zimbra urges customers to patch critical web client XSS flaw

First seen 10 Jul 2026, 13:43 UTC • Heise.De

Heise.De

Bleepingcomputer

Securityaffairs.Co

Scworld

Thehackernews

+11 •40.9

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

New cluster - AI summary will be generated shortly

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

17 entities, 22 inferred relationships (STIX 2.1).

Threat Actor (1)

Laundry Bear

Technique (5)

Data Breach
Phishing
T1041 - Exfiltration Over C2 Channel
T1059.007 - JavaScript
T1566 - Phishing

Vulnerability (3)

CVE-2025-48700
CVE-2025-66376
XSS

Weakness (1)

Cwe-79 - Cross-site Scripting (xss)

Indicator (4)

entities.in
german.it
istc-cloud.com
mailnalysis.com

Affected Platform (3)

OpenClaw
Microsoft Exchange
Zimbra Collaboration Suite

Relationships

Laundry Bear uses Data Breach
Laundry Bear uses Phishing
Laundry Bear uses T1041 - Exfiltration Over C2 Channel
Laundry Bear uses T1059.007 - JavaScript
Laundry Bear uses T1566 - Phishing
Laundry Bear exploits CVE-2025-48700
Laundry Bear exploits CVE-2025-66376
Laundry Bear exploits XSS
CVE-2025-48700 targets OpenClaw
CVE-2025-48700 targets Microsoft Exchange
CVE-2025-48700 targets Zimbra Collaboration Suite
CVE-2025-66376 targets OpenClaw
CVE-2025-66376 targets Microsoft Exchange
CVE-2025-66376 targets Zimbra Collaboration Suite
XSS targets OpenClaw
XSS targets Microsoft Exchange
XSS targets Zimbra Collaboration Suite
Laundry Bear related to Cwe-79 - Cross-site Scripting (xss)
Laundry Bear related to entities.in
Laundry Bear related to german.it
Laundry Bear related to istc-cloud.com
Laundry Bear related to mailnalysis.com

Continue Reading

Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Russia-Linked DRILLAPP Backdoor Targets Ukrainian Entities via Microsoft Edge Russian Hackers Target Zimbra Users, Compromise Hundreds of Emails Russia and China Intensify Cyber Threats Amid Geopolitical Tensions US Charges Russian Hacker for Facilitating Void Blizzard Cyber Espionage Campaign Russian Cyber Espionage Suspect Pleads Not Guilty in US Court