CVE-2025-66376Zimbra ZCS chained with CVE-2025-48700 to steal MFA backup codes
What broke
Zimbra ZCS had a vulnerability (CVE-2025-66376) that, chained with CVE-2025-48700, let attackers read MFA backup codes and application passwords from mailboxes. CERT-UA tracked the activity as UAC-0233. CISA added 66376 to KEV in mid-March 2026.
Why it matters
Backup codes and app passwords are standing credentials that skip the second factor. Stealing them from the mail system is an MFA bypass that does not need to break TOTP or WebAuthn. Mail is part of the identity plane whether the IAM team owns it or not.
What to do
- Patch Zimbra for both IDs in the chain.
- Rotate MFA backup codes and revoke app passwords after any suspected mailbox read.
- Prefer passkeys and disable app passwords where the IdP allows it.
- Hunt for new mail-forwarding rules and unexpected IMAP app-password use.
After you patch
Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.
- Revoke every session and refresh token, not just the passwords. A session issued before the patch is still valid after it.
- Enumerate accounts created or modified during the exposure window, including local accounts on the appliance itself, service accounts, and API tokens.
- Remove authentication methods you did not add. An attacker with administrative access enrols a factor so the access survives your remediation.
- Rotate every credential the compromised system could reach: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See secrets rotation.
- Assume the device is a pivot, not a destination. Check what it could authenticate to and treat that as in scope.
Sources
- NVD: CVE-2025-66376
- CISA KEV, mid-March 2026
- CERT-UA UAC-0233
Related identity CVEs
Related on Start with Identity
- CVEN-able N-central auth bypass, incomplete patch of CVE-2026-18556
N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- CVEBeyondTrust PRA and Remote Support unauthenticated command injection
Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- GlossaryHOTP
HMAC-based One-Time Password (RFC 4226). A counter-based one-time code and the basis for TOTP. Largely superseded by time-based codes and phishing-resistant met