Start with Identity
Subscribe
Identity CVE · Other

CVE-2025-66376Zimbra ZCS chained with CVE-2025-48700 to steal MFA backup codes

criticalCISA KEVActively exploited
Product: Zimbra Collaboration SuiteVendor: Synacor / ZimbraDisclosed: 2026-03-15Status: Actively exploitedNVD ↗CISA KEV ↗

What broke

Zimbra ZCS had a vulnerability (CVE-2025-66376) that, chained with CVE-2025-48700, let attackers read MFA backup codes and application passwords from mailboxes. CERT-UA tracked the activity as UAC-0233. CISA added 66376 to KEV in mid-March 2026.

Why it matters

Backup codes and app passwords are standing credentials that skip the second factor. Stealing them from the mail system is an MFA bypass that does not need to break TOTP or WebAuthn. Mail is part of the identity plane whether the IAM team owns it or not.

What to do

  • Patch Zimbra for both IDs in the chain.
  • Rotate MFA backup codes and revoke app passwords after any suspected mailbox read.
  • Prefer passkeys and disable app passwords where the IdP allows it.
  • Hunt for new mail-forwarding rules and unexpected IMAP app-password use.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.