CVE-2025-66376

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

March 18, 2026

Last Seen

July 25, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign80.8

Since July 2025, Russian state-backed hackers, known as Laundry Bear, have exploited a zero-click vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite to infiltrate Western government and commercial organizations. This attack method allows hackers to steal sensitive data without requirin...

APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine80.8

Russian state-backed hackers from APT28 are actively exploiting a high-severity stored cross-site scripting vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite (ZCS) to target Ukrainian government entities. The flaw allows unauthenticated attackers to execute remote code and harvest sen...

Russian Hackers Exploit Zimbra Zero-Day for Email Theft79.3

Russian state-sponsored hacking group Laundry Bear has been exploiting a zero-day vulnerability in the Zimbra Collaboration Suite, tracked as CVE-2025-66376, since at least July 2025. This stored cross-site scripting (XSS) flaw allows attackers to execute malicious JavaScript when victims view craft...

Russian APT Exploits Zimbra XSS to Target Ukrainian Government78.0

A Russian state-linked advanced persistent threat (APT) has targeted a Ukrainian government agency through a cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite, identified as CVE-2025-66376. The attack, named 'Operation GhostMail,' involves running scripts via HTML emails to...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (4)

Related Entities

Laundry Bear Void Blizzard APT28 Fancy Bear TA488 Strontium APT29 BlueDelta Cozy Bear Forest Blizzard Midnight Blizzard Sofacy

CVE-2025-66376

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Public Exploits

CVE Details

Related Clusters (4)

Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign

APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine

Russian Hackers Exploit Zimbra Zero-Day for Email Theft

Russian APT Exploits Zimbra XSS to Target Ukrainian Government

Related Articles (23)

CVE-2025-66376

826029

Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries

Russian attackers exploit zero-click vulnerability in Zimbra

Russian APT Laundry Bear perfects zero

Russian spies exploit unpatched Zimbra flaw to steal NATO member emails

Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets

Year

Zero

Russian Hackers Exploit New ‘Zero-Click’ Attack Against Western Organizations

TA488 Targets Zimbra Mailservers with Half

Zimbra urges customers to patch critical web client XSS flaw

Russian APT weaponizes critical Zimbra bug in Ukraine-targeted intrusions

AWS kills bucketsquatting

Updated CISA exploited flaws list adds SharePoint, Zimbra bugs | brief

CISA Warns of Zimbra Collaboration Suite Vulnerability Exploited in Attacks

Russian hackers exploit Zimbra flaw in Ukrainian govt attacks

Russian APT targets Ukraine via Zimbra XSS flaw CVE-2025

Critical Microsoft SharePoint Flaw Now Exploited in Attacks

CISA Adds Exploited Zimbra Collaboration Suite Flaw to Warning List

Warning about attacks on Cisco FMC, SharePoint and Zimbra

CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero

CISA orders feds to patch Zimbra XSS flaw exploited in attacks

Related Entities