CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks

CISA warns of active exploitation of vulnerabilities in Zimbra and SharePoint, while Cisco's firewall management software faces a critical zero-day used in ransomware attacks.

• •CVE-2025-66376 (CVSS 7.2): Stored XSS in Zimbra Classic UI via CSS @import directives in HTML emails, fixed in versions 10.0.18 and 10.1.13
• •CVE-2026-20963 (CVSS 8.8): Deserialization vulnerability in Microsoft SharePoint allowing unauthenticated remote code execution, fixed in January 2026
• •FCEB agencies must patch CVE-2025-66376 by April 1, 2026 and CVE-2026-20963 by March 23, 2026
• •Interlock ransomware group exploited Cisco CVE-2026-20131 (CVSS 10.0) as a zero-day since January 26, 2026, over a month before public disclosure
• •Targeted sectors include education, healthcare, manufacturing, and government; reflects a pattern of attackers targeting edge network devices from Cisco, Fortinet, and Ivanti