CVE-2025-66376 is a stored cross-site scripting vulnerability in Zimbra's Classic UI. It was weaponized by the Russia-linked threat actor Laundry Bear to deliver the ZimReaper JavaScript payload, targeting Zimbra mail servers of Western government and commercial organizations since at least July 2025.