What the advisory describes
On July 23 the NSA, CISA, and a coalition of more than two dozen partner agencies published a joint advisory on a Russian state-linked espionage campaign tracked as LAUNDRY BEAR, with corroborating research from Palo Alto Networks Unit 42 and Proofpoint. The group has been exploiting CVE-2025-66376, a stored cross-site-scripting flaw in the Classic UI of Zimbra Collaboration Suite, against Western targets since at least July 2025. The advisory names an unusually broad victim set: the defense industrial base, federal and local government, education, energy, law enforcement, media, non-governmental organizations, and technology firms across NATO members, Ukraine, and Africa. In the United States, targets included scientific, defense, and nuclear-related entities.
What makes the campaign notable is the modest severity score attached to the vulnerability at its center. CVE-2025-66376 carries a CVSS of 6.1, the kind of medium-rated webmail bug that rarely makes a patch-priority shortlist. Zimbra fixed it on November 6, 2025, the CVE was published in early January 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on March 18. Every organization compromised in this campaign was therefore running software with an available fix, in some cases for the better part of a year. The gap between a low-drama score and a nation-state outcome is the whole story here.
How a zero-click webmail flaw works
The exploit needs no click. A crafted HTML email abuses how Zimbra's Classic UI handles CSS import directives, and the malicious code runs the moment a victim opens the message inside an authenticated webmail session. To slip past Zimbra's content sanitizer, the attackers fragment an svg onload tag using fake import statements and HTML comments, a technique called tag-splitting, which the browser reassembles into working JavaScript after the filter has already passed it. The result is script execution with the full privileges of the logged-in mailbox, triggered by the ordinary act of reading an email. Zero-click delivery removes the human error that most phishing defenses are built to catch.
Once running, the script harvests aggressively. The advisory describes theft of the previous 90 days of email, the complete organizational address directory, browser-saved passwords, two-factor recovery codes, CSRF tokens, and Zimbra version details. The directory theft is its own multiplier, because a full internal contact map is the raw material for the next round of targeted phishing. The 90-day mail window hands the attacker current context on projects, relationships, and pending decisions. For an espionage operation, a single opened email converting into three months of correspondence plus the credentials to keep reading is close to an ideal outcome.
The persistence that outlives the patch
The most instructive detail is how LAUNDRY BEAR stays in. After the initial theft, the script enables IMAP access and generates a new Zimbra application passcode it labels ZimbraWeb. That application passcode is a legitimate feature, meant to let mail clients connect without the interactive login flow. Used this way, it becomes a durable backdoor that grants ongoing mailbox access and sidesteps the account's native two-factor authentication entirely. The victim can reset their password and the attacker's passcode keeps working, because app-specific credentials live outside the primary authentication path. Patching the XSS flaw does nothing to revoke a passcode already minted.
This is the part that should change how defenders think about the incident. Two-factor authentication is often treated as the control that ends the conversation about account takeover, and here it is quietly bypassed by a feature working exactly as designed. Application passwords, OAuth tokens, and mail-client passcodes are persistence mechanisms hiding in plain sight across most collaboration platforms. Responding to this campaign requires enumerating and revoking those secondary credentials, on top of forcing password resets and confirming the patch. Any Zimbra operator who patched months ago and considered the matter closed may still be hosting a ZimbraWeb passcode that never expired.
A medium CVE with strategic reach
Severity scores measure a vulnerability's technical characteristics, and they routinely fail to capture context. CVE-2025-66376 scores a 6.1 because it is a client-side scripting flaw that requires a user to view content, which the scoring model reads as friction. In practice, viewing email is the entire job, and a zero-click webmail exploit against a soft target is worth more to an intelligence service than many a 9.8 against hardened infrastructure. The lesson for patch programs is that a CVSS number is an input, and the software's role decides the real priority. Webmail is a first-class espionage target regardless of what the base score says.
The victim profile reinforces the point. Espionage groups pick targets by intelligence value, and Zimbra's user base skews toward the government, education, and non-profit organizations that favor self-hosted, cost-effective mail over the large commercial suites. That population combines high-value correspondence with lean security teams and slow patch cycles, which is precisely why a medium-rated flaw against it has produced a multi-year campaign. Enterprises that dismissed this CVE on its score misread the assignment. The right question was always who runs the affected software and what an adversary would gain from their inbox.
What to do now
Patch to Zimbra 10.0.18 or 10.1.13 or later immediately if that has somehow not happened, then assume compromise for any instance that ran the vulnerable versions during the exposure window. The critical follow-on step is credential hygiene: enumerate and revoke application passcodes and IMAP-linked secrets, force password resets, and rotate anything a compromised mailbox could have exposed. Review the advisory's indicators for the ZimbraWeb passcode and anomalous IMAP sessions, and check mail logs for the 90-day exfiltration pattern the campaign leaves behind. A clean patch status is a necessary condition and a wholly insufficient one for declaring this incident closed.
Strategically, the campaign is an argument for scrutinizing self-hosted collaboration software the way you would any internet-facing crown jewel. On-premises webmail concentrates sensitive correspondence, tends to lag on patches, and exposes features like app passcodes that create persistence outside the main login flow. Leaders running Zimbra or similar platforms should map who depends on them, tighten patch SLAs for anything KEV-listed regardless of score, and build the muscle to revoke secondary credentials during an incident. LAUNDRY BEAR did not use a novel weapon. It used a known, patched, medium-rated bug against organizations that had not finished responding to it.
