CISA Warns of Zimbra, Share Point Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks
Summary: CISA added CVE-2025-66376 in Synacor Zimbra Collaboration Suite and CVE-2026-20963 in Microsoft Office SharePoint to its KEV catalog, citing active exploitation, with FCEB patch deadlines of April 1, 2026 and March 23, 2026 respectively. Seqrite Labs attributed the Zimbra flaw's exploitation to a suspected Russian state-sponsored campaign called Operation GhostMail, which used a social-engineered internship inquiry email sent January 22, 2026 from a likely compromised National Academy of Internal Affairs address to deliver obfuscated JavaScript in the HTML body against Ukraine's State Hydrographic Service, harvesting credentials, session tokens, 2FA recovery codes, browser-saved passwords and 90 days of mailbox contents exfiltrated over DNS and HTTPS.
What you should know: Operation GhostMail carried the entire attack chain in a single email body with no attachment, link or macro, so endpoint detection had nothing to catch while 90 days of mailbox data and 2FA recovery codes left over DNS and HTTPS. Separately, Interlock ransomware actors exploited a CVSS 10.0 Cisco firewall management flaw (CVE-2026-20131) from January 26, 2026, more than a month before public disclosure.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-66376CVE-2026-20131CVE-2026-20963
- Related
- CVE-2026-20131: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Mar 19, 2026CVE-2026-20963: Microsoft Share Point Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Mar 18, 2026CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · Mar 18, 2026