A Zimbra XSS zero-day let a Russian espionage group read mailboxes and steal 2FA codes for months

A joint advisory from NSA, CISA, and partner agencies, published July 23, 2026, details a campaign that started in July 2025 and ran into February 2026 against Zimbra's Classic UI. The bug, CVE-2025-66376, is a stored cross-site-scripting flaw: a target only had to view a malicious email for JavaScript to execute inside their already-authenticated session, no click, no credential entry. From there the actor pulled the last 90 days of mail, the organization's full address directory, passwords saved in the browser, and two-factor recovery and scratch codes. Targets spanned NATO governments, Ukraine, the CIS, and African, US government, scientific, and defense-industrial entities including nuclear facilities. Zimbra patched in Collaboration 10.0.18 and 10.1.13 (current is 10.1.20); CISA added the CVE to its Known Exploited Vulnerabilities catalog on March 18, 2026.

Why it matters

Stealing MFA recovery codes alongside mail is the detail worth sitting with: it converts a one-time mailbox read into durable re-entry, because scratch codes are exactly the fallback that bypasses whatever second factor you rolled out after the first compromise. A stored XSS in a webmail client turns "authenticated session" into the attacker's credential, no phishing page, no token theft technique needed beyond a viewed email.

If Zimbra is in your stack, confirm you're on 10.1.13 or later specifically, not just "patched at some point," and treat any 2FA recovery codes issued before your patch date as burned.

Source: The Hacker News