CVE-2025-66376
Known exploited · CISA KEV
CVSS 7.2 HIGH: zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style… EPSS 20% (97th percentile).
CISA federal remediation date Apr 1
Vulnerabilities & Exploits · Web App Attack
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2025-66376 (Synacor Zimbra Collaboration Suite cross-site scripting) and CVE-2026-20963 (Microsoft SharePoint deserialization of untrusted data). Both entries are based on evidence of active exploitation. BOD 22-01 remediation deadlines apply to Federal Civilian Executive Branch agencies.
1 source · Mar 27
Known exploited · CISA KEV
CVSS 7.2 HIGH: zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style… EPSS 20% (97th percentile).
CISA federal remediation date Apr 1
CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog | CISA
CISA Adds One Known Exploited Vulnerability to Catalog CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
originalCISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog | CISA
originalCISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog | CISA
originalPart of the PlainSec briefing for 2026-03-28
Every edition of this story: Two Actively Exploited Vulnerabilities Added to KEV Catalog