Stored Cross-Site Scripting in Synacor Zimbra Collaboration Suite Classic UI
CISA: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
CVSS 3.1
6.1medium
EPSS
20%p97
Published
()
KEV added
AI analysis
Zimbra Collaboration Suite (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 is vulnerable to stored cross-site scripting through its Classic webmail interface. An attacker sends an HTML e-mail containing a Cascading Style Sheets (CSS) @import directive, and when a recipient opens that message in Classic UI, the injected content executes as script in the victim's browser session. Successful exploitation lets an attacker run arbitrary JavaScript in the Zimbra webmail context, potentially hijacking the session, reading mail, or acting as the user, consistent with the cross-scope impact reflected in the 6.1 CVSS score. Only deployments running the affected ZCS 10/10.1 versions with the Classic UI enabled are exposed; organizations on patched releases or not using Classic UI are not impacted. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-03-18, confirming exploitation in the wild, and recent reporting describes Zimbra flaws being used by Russian-aligned espionage actors against Western and Ukrainian targets.
What to do: Upgrade ZCS to 10.0.18 or 10.1.13 (or later) following vendor instructions, as required by CISA's BOD 22-01 KEV guidance; federal agencies and critical infrastructure should prioritize this by the catalog deadline. Until patched, filter or sanitize HTML mail containing CSS @import directives and consider restricting or disabling the Classic UI. Check mailboxes and webmail access logs for suspicious HTML messages and unexplained session activity, which may indicate exploitation.
Affected
Synacor Zimbra Collaboration Suite (ZCS) 10
10.x before 10.0.18
Synacor Zimbra Collaboration Suite (ZCS) 10.1
10.1.x before 10.1.13
Estimated exposure
largetens of thousands of internet-exposed Zimbra servers (public internet scans typically surface on the order of 50,000+ Zimbra instances), affecting an estimated… — Estimate based on public internet scan counts of Zimbra mail servers, which consistently show tens of thousands of exposed instances concentrated among hosting providers, ISPs, government agencies, and enterprises; the subset with Classic…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CISA Known Exploited Vulnerability
Affected
Synacor Zimbra Collaboration Suite (ZCS)
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CERT Polska and CISA report active exploitation of Zimbra RCE CVE-2026-73570, with 267 instances compromised per Shadowserver.
CVE-2026-73570 (CVSS 8.9) enables unauthenticated command injection and remote code execution in Zimbra Collaboration before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled, via crafted SMTP requests. CISA added the flaw to its KEV catalog on August 21, 2026, with a federal patch deadline of August 24. The Shadowserver Foundation counted 267 compromised instances as of August 24, 2026, led by the US (46), Sweden (21), France (20) and Germany (17). Separately, Russia-linked Laundry Bear has weaponized Zimbra stored XSS CVE-2025-66376 against Western government and commercial mail servers since at least July 2025, delivering the ZimReaper payload.