A Russian state-sponsored threat actor is exploiting a critical cross-site scripting (XSS) vulnerability in Zimbra Collaboration, identified as CVE-2025-66376, to target users in Ukraine. This high-severity flaw, with a CVSS score of 7.2, allows attackers to run scripts via HTML emails, potentially taking over a user's email account. The vulnerability is a stored XSS flaw in the Classic UI, where attackers can abuse CSS @import directives in email HTML to execute malicious code. The exploitation of this bug enables attackers to gain unauthorized access to sensitive information. The active exploitation of CVE-2025-66376 by a Russian APT group1 highlights the need for immediate attention to this vulnerability. So what matters to practitioners is that the exploitation status of this flaw necessitates a prompt patching or monitoring decision to prevent potential security breaches.