The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive for U.S. Federal Civilian Executive Branch (FCEB) agencies to remediate a high-severity stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) that is actively exploited in the wild. The flaw enables unauthenticated attackers to inject malicious JavaScript via maliciously crafted HTML emails using CSS “@import” directives. The vulnerability, tracked as CVE-2025-66376, was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, and poses significant risks including session hijacking and sensitive data theft, with agencies required to patch by no later than April 1, 2026, while private sector organizations are strongly encouraged to follow suit. Real-world exploitation has already been observed in a targeted cyber-espionage campaign attributed to Russian state-backed group APT28 (Fancy Bear), which used a highly evasive phishing technique embedding the exploit entirely within the body of a single email (disguised as a legitimate message) sent to Ukraine’s State Hydrographic Service. When opened in Zimbra’s webmail interface, the payload executed within the victim’s authenticated session, enabling the theft of credentials, session tokens, 2FA backup codes, browser-stored passwords, and extensive mailbox data without deploying malware or triggering traditional defenses. This activity reflects a broader pattern of Zimbra exploitation, with multiple threat actors (including APT29 and Winter Vivern) leveraging similar vulnerabilities in prior campaigns to compromise government and critical infrastructure targets, underscoring Zimbra’s continued role as a high-value target in both financially motivated and state-sponsored operations. CTIX analysts strongly urge vulnerable agencies or firms to ensure they follow the CISA guidance and patch the flaw to prevent exploitation.