News Date: 2026-07-23
A Russian state-supported espionage operation reportedly exploited a Zimbra Collaboration vulnerability to compromise email accounts when specially crafted messages were displayed. The campaign is especially concerning because victims did not need to open an attachment, enable a macro or follow a link. Rendering the malicious email in a vulnerable Zimbra Classic session could be enough to trigger the attack.
A Mailbox Attack With Lasting Consequences
The vulnerability, CVE-2025-66376, is a stored cross-site scripting flaw affecting older Zimbra 10.0 and 10.1 releases. Malicious HTML embedded in an email could execute JavaScript with the privileges of the authenticated webmail user.
The associated payload, identified by researchers as ZimReaper, was designed to collect far more than individual messages. It could obtain recently stored email, address directory information, browser-supplied passwords, session data and two-factor authentication recovery codes. The malware could also create an application-specific password, potentially giving the attacker access through protocols such as IMAP or SMTP.
This persistence mechanism is important because changing the user's primary password may not invalidate an application credential created by the attacker. An organization could therefore believe an account had been secured while unauthorized access continued through a separate authentication path.
Response Requires More Than Patching
- Upgrade vulnerable Zimbra systems to a fully supported and patched release.
- Invalidate existing sessions and reset credentials for potentially exposed accounts.
- Regenerate two-factor recovery codes and review application-specific passwords.
- Investigate unexpected IMAP enablement and unusual mailbox API activity.
- Examine DNS traffic for suspicious, encoded subdomain requests associated with data theft.
I believe the broader lesson is that email preview functions must be treated as active content processors rather than passive reading tools. Security training cannot prevent an attack that starts when a legitimate user simply views a message.
In my view, organizations operating self-hosted email platforms need to combine rapid patching with identity forensics. The server update prevents future exploitation, but it does not remove credentials or persistence established before the fix. Administrators should assume that any mailbox exposed through a vulnerable interface may require a complete authentication review, especially in government, defense, research and critical infrastructure environments.