Federal News
CISA Mandates Federal Patch for Zimbra XSS Vulnerability
March 20, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a mandatory directive requiring all U.S. federal agencies to patch a critical stored cross-site scripting (XSS) vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite by April 1, 2026. This vulnerability has been actively exploited by the Russian state-sponsored APT28 group in targeted cyberattacks against Ukrainian government entities, including the Ukrainian State Hydrology Agency, compromising credentials and sensitive email data. The exploitation involves stealthy phishing campaigns and silent script execution that harvests extensive user credentials and mailbox contents, highlighting the urgent need for federal agencies and contractors using Zimbra to implement patches, conduct account audits, and enhance monitoring to mitigate risks.
- Why this matters: Federal agencies must comply with CISA's patching mandate to protect critical collaboration infrastructure from active exploitation by sophisticated threat actors.
- Organizations supporting federal IT environments should prioritize deploying patches for CVE-2025-66376 and implement enhanced monitoring of SOAP API calls indicative of exploitation attempts.
- Contractors providing cybersecurity services have opportunities to assist agencies with vulnerability remediation, incident response, and security audits related to Zimbra deployments.
- This directive underscores the importance of proactive vulnerability management and rapid response to known exploited vulnerabilities in government procurement and IT operations.
The script executes silently in the browser and begins harvesting credentials, session tokens, backup 2FA codes, browser-saved passwords, and the contents of the victim’s mailbox going back 90 days with all the data exfiltrated over both DNS and HTTPS.
— Seqrite Labs
SOAP API monitoring should be deployed, as calls to GetScratchCodesRequest and CreateAppSpecificPasswordRequest are rarely seen in normal usage and warrant immediate investigation.
— Tushar Subhra Dutta
Agencies
Cybersecurity and Infrastructure Security Agency, Federal Civilian Executive Branch, Ukrainian State Hydrology Agency, Ministry of Infrastructure of Ukraine, National Academy of Internal Affairs
Vendors
Zimbra, Synacor, Seqrite Labs
Locations
Sources
- Russian APT Exploits Zimbra Vulnerability Against Ukraine - SecurityWeek · SecurityWeek · Mar 19
- Russian APT Exploits Zimbra XSS to Target Ukrainian Government in ‘Operation GhostMail’ · CyberSecurityNews · Mar 20
- CISA orders feds to patch Zimbra XSS flaw exploited in attacks · BleepingComputer · Mar 18