Deep Dive: Zimbra Stored XSS zero-day (CVE-2025-66376) exploited by Russian APT LAUNDRY BEAR

If you're managing Zimbra Collaboration Suite (specifically the Classic UI), this is one you can't ignore.

CVE-2025-66376 is a stored XSS vulnerability that gives attackers a direct path to mailbox theft and abuse of authenticated webmail sessions. It was actively exploited as a zero-day before the November 2025 fixes were released, and joint government advisories have tied the activity to the Russian state-sponsored group LAUNDRY BEAR (also known as Void Blizzard, CL-STA-1114, and TA488).

We put together a comprehensive article explaining exactly how this flaw works. It covers the technical root cause, affected versions, exploitation evidence, public PoC status, and the specific actions you need to take to mitigate the risk and strengthen your email posture.

You can read the full breakdown here: https://socradar.io/blog/cve-2025-66376-russian-apt-zimbra-zero-day/

Has anyone here had to deal with the fallout from this specific Zimbra zero-day yet?