{"uuid": "cb0819e9-30f9-4560-9f7c-ac88ae3da60d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66376", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/116970644999399862", "content": "\ud83d\udea8\ud83c\uddf7\ud83c\uddfa Russian state-backed hackers can steal 90 days of Zimbra emails when a victim simply views a message\nA joint international advisory warns that LAUNDRY BEAR is exploiting CVE-2025-66376 against unpatched Zimbra Collaboration Suite servers.\nThe malicious JavaScript executes when an email is viewed in a vulnerable version of Zimbra webmail. No link click, attachment, or additional interaction is required.\nThe group\u2019s Ulej tool attempts to steal:\n\u2022 The victim\u2019s last 90 days of emails\u2022 Email addresses and organization directories\u2022 Saved passwords\u2022 2FA recovery codes\u2022 Newly created application passwords\nThe attackers can also enable IMAP and create an application password named \u201cZimbraWeb\u201d to maintain access to compromised mailboxes.\nThe vulnerability was patched in Zimbra 10.0.18 and 10.1.13. Organizations running older versions should update immediately and investigate for signs of compromise.\nFull details: https://www.ic3.gov/CSA/2026/260723.pdf", "creation_timestamp": "2026-07-23T18:13:19.350655Z"}