CVE-2025-66376Zimbra ZCS chained with CVE-2025-48700 to steal MFA backup codes
What broke
Zimbra ZCS had a vulnerability (CVE-2025-66376) that, chained with CVE-2025-48700, let attackers read MFA backup codes and application passwords from mailboxes. CERT-UA tracked the activity as UAC-0233. CISA added 66376 to KEV in mid-March 2026.
Why it matters
Backup codes and app passwords are standing credentials that skip the second factor. Stealing them from the mail system is an MFA bypass that does not need to break TOTP or WebAuthn. Mail is part of the identity plane whether the IAM team owns it or not.
What to do
- Patch Zimbra for both IDs in the chain.
- Rotate MFA backup codes and revoke app passwords after any suspected mailbox read.
- Prefer passkeys and disable app passwords where the IdP allows it.
- Hunt for new mail-forwarding rules and unexpected IMAP app-password use.
After you patch
Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.
- Revoke every session and refresh token, not just the passwords. A session issued before the patch is still valid after it.
- Enumerate accounts created or modified during the exposure window, including local accounts on the appliance itself, service accounts, and API tokens.
- Remove authentication methods you did not add. An attacker with administrative access enrols a factor so the access survives your remediation.
- Rotate every credential the compromised system could reach: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See secrets rotation.
- Assume the device is a pivot, not a destination. Check what it could authenticate to and treat that as in scope.
Sources
- NVD: CVE-2025-66376
- CISA KEV, mid-March 2026
- CERT-UA UAC-0233
Related identity CVEs
Related on Start with Identity
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning
- CVEN-able N-central auth bypass, incomplete patch of CVE-2026-18556
N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be