Product

Zimbra Collaboration Suite

2 briefs RSS

TA488 Exploits Zimbra Mailservers with Half-Click Vulnerability CVE-2025-66376

Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.

PoC Zimbra Collaboration Suite +10 TA488 +2 espionage xss zimbra apt state-sponsored half-click cve-2025-66376

2r 9t 3c 7i updated 1w ago

medium advisory

CVE-2026-42897 Microsoft Exchange Server Cross-Site Scripting Vulnerability

2 rules 2 TTPs 1 CVE 7 IOCs

CVE-2026-42897 is a cross-site scripting (XSS) vulnerability in Microsoft Exchange Server that allows an attacker to perform spoofing attacks by injecting malicious scripts into web pages.

PoC Exchange Server +6 xss spoofing exchange

2r 2t 1c 7i updated 6d ago