CISA has advised U.S. government bodies to install security updates for two weaknesses in Synacor Zimbra Collaboration Suite (ZCS) and Microsoft Office SharePoint, because they are being actively exploited.

The vulnerabilities are:

• CVE-2025-66376 (CVSS score: 7.2): A stored XSS vulnerability in ZCS’s Classic UI. Attackers could use CSS @import directives in an HTML email. (Patched in versions 10.0.18 and 10.1.13 in November 2025)
• CVE-2026-20963 (CVSS score: 8.8): A deserialization vulnerability in Microsoft Office SharePoint. It allows unauthorized attackers to remotely execute code. (Patched in January 2026)

Currently, there are no publicly available reports detailing the exploitation of these vulnerabilities, including who is exploiting them or the extent of these activities. Given the active exploitation, FCEB agencies should patch CVE-2025-66376 by April 1, 2026, and CVE-2026-20963 by March 23, 2026.

This announcement follows the revelation by Amazon that Interlock ransomware actors have exploited a critical security flaw in Cisco’s firewall management software (CVE-2026-20131, CVSS score: 10.0) since January 26, 2026, over a month before public disclosure.

“Interlock has historically targeted sectors where operational downtime leads to maximum pressure for payment,” Amazon stated. These sectors include education, engineering, architecture, construction, manufacturing, industrial, health care, and government organizations.

This attack again highlights how threat actors persistently target edge network devices from various vendors, like Cisco, Fortinet, and Ivanti, to initially compromise target networks. The weaponization of CVE-2026-20131 as a zero-day suggests that attackers prioritize finding unknown vulnerabilities to gain elevated access.