CVE-2025-66376: Zimbra Webmail — Zero-Click Espionage Risk (June 2025)

CVE-2025-66376 — Zimbra Webmail

CVE-2025-66376 is a high-severity vulnerability in Zimbra Collaboration Suite webmail, currently exploited in zero-click phishing campaigns by Russia-aligned Laundry Bear. The flaw allows remote attackers to execute malicious JavaScript on target accounts without user interaction, enabling credential theft and mailbox compromise. Active exploitation is confirmed; patching is urgent.

Attack Vector

Attackers embed malicious JavaScript directly into email messages sent to Zimbra users. The exploit is triggered automatically when the email is processed by the Zimbra webmail client—no user click or interaction is required. This zero-click vector bypasses traditional phishing defenses and can lead to full mailbox access and lateral movement. Indicators of compromise (IOCs) are not specified, but defenders should monitor for anomalous JavaScript execution within mailboxes and unexpected authentication events.

Who Is at Risk

All organizations running Zimbra Collaboration Suite webmail are exposed, especially those with externally accessible instances. Confirmed targets include Ukrainian and U.S. government agencies, NATO, defense, transportation, finance, and high science organizations. Both government and commercial sectors are affected globally. Zimbra users who have not applied the latest security updates are at immediate risk of compromise.

Patch & Mitigate

• Patch: Apply the latest Zimbra security update addressing CVE-2025-66376 immediately. If patching is not possible, disable webmail access or switch to an unaffected mail client.
• Workaround: Restrict external access to Zimbra webmail and implement strict email filtering for embedded scripts.
• Detect: Audit mail server logs for suspicious JavaScript payloads in emails, monitor for unauthorized mailbox access, and review authentication logs for anomalies.

MITRE ATT&CK

• TA0001 — Initial Access: The attacker delivers exploit-laden emails to gain entry without user action.
• TA0002 — Execution: Malicious JavaScript executes automatically upon email processing in the webmail client.
• TA0005 — Defense Evasion: Zero-click nature bypasses user awareness and standard phishing detection tools.

Source: https://www.hendryadrian.com/international-alert-spotlights-russia-linked-attacks-on-zimbra-webmail/