Vulnerabilities

In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence, potentially allowing unauthorized disclosure of sensitive files within the web application directory.

CVE-2026-73570 is an OS command injection vulnerability (CWE-78) in Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20, caused by improper sanitization of untrusted input during SNMP notification processing. It is triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled: an unauthenticated attacker sends specially crafted SMTP requests that the flawed notification path turns into execution of arbitrary operating system commands. Successful exploitation runs commands as the Zimbra user, giving attackers control of the mail server's service account with high confidentiality and integrity impact across the host. Only ZCS deployments running the optional SNMP component with notifications enabled are vulnerable; other Zimbra installs are not exposed to this specific flaw. The flaw is under active exploitation: CISA added it to the KEV catalog on 2026-08-21, Poland's CERT has warned of in-the-wild attacks, unpatched Zimbra servers are reported compromised, and two public proof-of-concept exploits exist.

Do: Upgrade to Zimbra Collaboration Suite 10.1.20 or later per vendor instructions; as an interim mitigation, disable SNMP notifications or remove the zimbra-snmp package on hosts that do not need it. Federal operators must satisfy the CISA KEV/BOD 26-04 requirement, and all administrators of internet-facing Zimbra servers should hunt for signs of compromise (unexpected processes or persistence under the zimbra user) since unpatched systems are already being exploited.

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after operations such as enabling two-factor authentication or changing a password may lack CSRF enforcement. While such a token is active, authenticated SOAP requests that trigger token generation or state changes can be performed without CSRF validation. An attacker could exploit this by inducing a victim to submit crafted requests, potentially allowing sensitive account actions such as disabling two-factor authentication. The issue is mitigated by ensuring CSRF protection is consistently enforced for all issued authentication tokens.

Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious JavaScript into a crafted URL. When a victim user accesses the link, the injected script executes in the context of the Zimbra webmail application, which could allow the attacker to perform actions on behalf of the victim.

Zimbra Collaboration Suite (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 is vulnerable to stored cross-site scripting through its Classic webmail interface. An attacker sends an HTML e-mail containing a Cascading Style Sheets (CSS) @import directive, and when a recipient opens that message in Classic UI, the injected content executes as script in the victim's browser session. Successful exploitation lets an attacker run arbitrary JavaScript in the Zimbra webmail context, potentially hijacking the session, reading mail, or acting as the user, consistent with the cross-scope impact reflected in the 6.1 CVSS score. Only deployments running the affected ZCS 10/10.1 versions with the Classic UI enabled are exposed; organizations on patched releases or not using Classic UI are not impacted. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-03-18, confirming exploitation in the wild, and recent reporting describes Zimbra flaws being used by Russian-aligned espionage actors against Western and Ukrainian targets.

Do: Upgrade ZCS to 10.0.18 or 10.1.13 (or later) following vendor instructions, as required by CISA's BOD 22-01 KEV guidance; federal agencies and critical infrastructure should prioritize this by the catalog deadline. Until patched, filter or sanitize HTML mail containing CSS @import directives and consider restricting or disabling the Classic UI. Check mailboxes and webmail access logs for suspicious HTML messages and unexplained session activity, which may indicate exploitation.

Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion (RFI) flaw (CWE-98) reachable through its /h/rest endpoint. By sending crafted requests to /h/rest, a remote attacker can influence the application's internal request dispatching and cause the server to include arbitrary files from the WebRoot directory, potentially exposing sensitive file content or executing attacker-influenced file content reachable there. An attacker who abuses this flaw may gain information disclosure or further compromise of the ZCS server; the available data does not specify authentication requirements or confirm full remote code execution. Any organization running Zimbra Collaboration Suite, especially internet-facing ZCS email and collaboration servers, is potentially affected, though specific affected version ranges were not provided in the available data. The flaw was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-01-22, indicating confirmed exploitation in the wild, and EPSS assigns a 49.4% probability of exploitation within 30 days (99th percentile); no public proof-of-concept is known.

Do: Apply the patched ZCS release per Synacor's/Zimbra's advisory (specific patched versions were not provided in the available data) and follow CISA KEV required actions, including applicable BOD 22-01 guidance for federal agencies. Review access logs for crafted or anomalous requests to /h/rest and restrict internet exposure of ZCS endpoints until the patch is deployed. Ransomware association is unknown, so treat exploitation activity as potentially preparatory to broader compromise.

Zimbra Collaboration Suite (ZCS) 8.8.15, 9.0, 10.0, and 10.1 contain a cross-site scripting (XSS) flaw in the Classic UI caused by insufficient sanitization of HTML email content, involving crafted tag structures and attribute values that use @import directives and other script injection vectors. An attacker triggers it simply by getting a user to view a crafted email message in the Classic UI, with no additional user interaction required. Successful exploitation executes arbitrary JavaScript within the victim's session, potentially exposing sensitive mailbox information or enabling unauthorized actions under the victim's identity. Any organization running the affected ZCS branches — particularly internet-facing mail servers whose users receive untrusted email — is in scope. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-20, confirming active exploitation in the wild; no public proof-of-concept is known, and EPSS puts 30-day exploitation probability at about 1.7%.

Do: Upgrade ZCS to the latest patched builds of the affected 8.8.15/9.0/10.0/10.1 branches per Synacor/Zimbra's security advisory (no specific fixed version is listed here); federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use. Because the flaw is specific to the Classic UI, having users work in the Modern UI instead of the Classic UI reduces exposure until patching is complete. Review mail server and web client logs for users who viewed suspicious HTML-formatted messages as an indicator of targeting.

An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, including malformed tags with embedded JavaScript. The vulnerability is triggered when a user views a specially crafted email in the Classic UI, requiring no additional user interaction.

In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying contacts, changing account settings, and accessing sensitive user data when an authenticated user visits a malicious website.

CVE-2025-27915 is a stored cross-site scripting (XSS) flaw in the Classic Web Client of Synacor Zimbra Collaboration Suite (ZCS) 9.0, 10.0, and 10.1, caused by insufficient sanitization of HTML content in ICS calendar files. It is triggered when a user views an email message containing a malicious ICS entry, at which point embedded JavaScript executes in the victim's session via an ontoggle event handler inside a tag. A successful attacker can run arbitrary JavaScript in the victim's session and perform unauthorized actions on the account, notably creating email filters that silently redirect messages to attacker-controlled addresses, enabling data exfiltration. Any organization running the affected ZCS versions whose users read mail through the Classic Web Client is exposed, since delivery of a single crafted email can compromise a session. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2025-10-07, and public reporting describes active zero-day attacks, including targeting of the Brazilian military via malicious ICS files.

Do: Upgrade affected ZCS 9.0, 10.0, and 10.1 deployments to the latest patched builds per Zimbra's security advisory and apply any vendor-recommended mitigations (federal agencies must act per CISA KEV/BOD 22-01 requirements). Hunt for suspicious ICS-based emails and calendar entries, and review user mail filter rules for unauthorized forwarding or redirection to attacker-controlled addresses. Consider restricting or disabling Classic Web Client access until systems are patched.

CVE-2025-25064 is a SQL injection flaw in the ZimbraSync Service SOAP endpoint of Zimbra Collaboration Suite, caused by insufficient sanitization of a user-supplied parameter. An authenticated attacker triggers it by sending a crafted SOAP request with malicious content in a specific parameter, allowing arbitrary SQL queries to be injected into the backend database. Successful exploitation can let the attacker retrieve email metadata from the database, with the high CVSS 8.8 score reflecting potentially serious confidentiality, integrity and availability impact. It affects Zimbra Collaboration 10.0.x prior to 10.0.12 and 10.1.x prior to 10.1.4, so any organization running those branches with the sync service exposed is in scope. As of the advisory date there is no public proof-of-concept, it is not listed in CISA KEV, but its EPSS of 36.7% (98th percentile) indicates an elevated likelihood of exploitation attempts within 30 days, and fixes were shipped in Zimbra's recent security release alongside patches for stored XSS and SSRF issues.

Do: Upgrade Zimbra Collaboration to 10.0.12 (for the 10.0.x branch) or 10.1.4 (for the 10.1.x branch), or later, applying the current security patch release which also fixes related stored XSS and SSRF issues. Because exploitation requires authentication, review for suspicious or compromised accounts and restrict exposure of the ZimbraSync Service SOAP endpoint until patched. Monitor vendor advisories for updates on exploitation activity given the elevated EPSS score.

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.

An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmail due to insufficient sanitization of the packages parameter. Attackers can bypass the existing checks by using encoded characters, allowing the injection and execution of arbitrary JavaScript within a victim's session.

An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper sanitization of user input. This allows an attacker to inject malicious code into specific fields of an e-mail message. When the victim adds the attacker to their contacts, the malicious code is stored and executed when viewing the contact list. This can lead to unauthorized actions such as arbitrary mail sending, mailbox exfiltration, profile picture alteration, and other malicious actions. Proper sanitization and escaping of input fields are necessary to mitigate this vulnerability.

CVE-2024-50599 is a reflected Cross-Site Scripting (XSS) flaw (CWE-79) in one of the webmail calendar endpoints of Zimbra Collaboration Suite (ZCS) 8.8.15, caused by improper handling of user-supplied input that is reflected back into the HTML response. An attacker triggers it by getting a victim to click a crafted link to the calendar endpoint; the injected code is then reflected and executed in the victim's browser. Successful exploitation lets the attacker run script in the victim's webmail session context, with potential to steal session information or act as the user (CVSS 6.1 medium, user interaction required, scope changed). Organizations running ZCS 8.8.15, particularly those exposing webmail to the internet, are affected. The flaw is not yet in the CISA KEV catalog and no public proof-of-concept is known, but the 60.7% EPSS score (99th percentile) indicates a high probability of exploitation within 30 days.

Do: Apply the latest 8.8.15 patch level published by Synacor in its security advisory, or migrate to a currently supported ZCS release, without delay given the elevated EPSS score. Restrict internet exposure of the webmail calendar endpoint where possible and review webmail access logs for anomalous requests to calendar URLs. Caution users against clicking untrusted links that point to their webmail domain, since reflected XSS requires user interaction.

CVE-2024-45519 is an access-control weakness (CWE-284) in the postjournal service of Synacor Zimbra Collaboration Suite (ZCS) that allows an unauthenticated remote attacker to execute operating-system commands on the mail server. The postjournal service handles Zimbra's email journaling, and the flaw is reached by sending crafted mail/SMTP traffic to a vulnerable server, with no credentials or user interaction required. Successful exploitation gives the attacker command execution on the ZCS host, typically a foothold for stealing mailbox data and credentials, deploying webshells, or staging broader intrusion and ransomware activity. Any organization running ZCS is in scope, especially internet-exposed mail servers operated by enterprises, hosting/ISP providers, education, and government. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2024-10-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile), though no public PoC is known.

Do: Upgrade ZCS to the latest patch release per Synacor's advisory for this CVE, prioritizing internet-facing mail servers, since CISA's KEV required action is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable. If patching cannot be done immediately, restrict untrusted network access to the postjournal/SMTP path and treat the host as presumptively compromised because exploitation is already in the wild. Check postjournal logs and unexpected child processes or dropped files on the server for signs of compromise, and re-verify after patching.

CVE-2024-27443 is a cross-site scripting vulnerability (CWE-79) in the CalendarInvite feature of the Zimbra webmail classic user interface in Synacor Zimbra Collaboration Suite (ZCS). It is triggered when a user's browser renders an email containing a crafted calendar header, causing attacker-controlled JavaScript to execute within the webmail session. Successful exploitation allows an attacker to run arbitrary JavaScript in the victim's browser, enabling session/cookie theft and actions performed as the victim inside webmail; no public proof-of-concept is known and CVSS has not yet been scored. Organizations running ZCS where users access mail through the classic webmail UI are affected (deployments restricted to the modern UI are not impacted), though specific affected version ranges have not been published in the available data. The flaw was added to the CISA KEV catalog on 2025-05-19, confirming exploitation in the wild, and EPSS currently estimates a 23.6% probability of exploitation within 30 days (98th percentile).

Do: Update ZCS to the patched release for your branch per Synacor/Zimbra's security advisory (specific fixed version numbers are not included in the available data) and confirm whether the classic webmail UI is enabled for any users. Review webmail access logs for suspicious calendar-invite traffic, and note that federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use of the product if mitigations are unavailable.

CVE-2023-37580 is a cross-site scripting flaw (CWE-79) in Synacor Zimbra Collaboration Suite's webmail interface, publicly described as a stored XSS in which attacker-supplied content persists and executes in victims' browsers. An attacker delivers crafted content (typically a malicious email or message) that, when viewed by a user in the Zimbra webmail client, runs attacker-controlled JavaScript within that user's authenticated session. Successful execution impacts the confidentiality and integrity of the victim's mailbox: the attacker can steal session cookies or credentials, read or alter mail, and act as the user. Any organization running a vulnerable ZCS release is affected, including self-hosted on-premises deployments and providers hosting Zimbra webmail for customers. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2023-07-27, confirming exploitation in the wild (ransomware association unknown), while no public proof-of-concept is posted, CVSS is not yet scored, and EPSS assigns a 46.7% probability of exploitation within 30 days (99th percentile).

Do: Apply the latest ZCS patch release addressing CVE-2023-37580 per the Synacor/Zimbra security advisory, as CISA's required action directs, or discontinue use of the affected deployment if mitigation is unavailable; because the flaw is on the KEV list, prioritize internet-facing webmail servers. While patching is pending, restrict webmail exposure (VPN or IP allowlisting) and review webmail and mail-delivery logs for signs of exploitation. Confirm the installed ZCS version and applied patch level against the vendor advisory, since this dataset does not list fixed version numbers.

CVE-2023-34192 is a critical (CVSS 3.1: 9.0) cross-site scripting (CWE-79) flaw in Synacor Zimbra Collaboration Suite (ZCS) 8.8.15. A remote, authenticated attacker submits a crafted script through the /h/autoSaveDraft endpoint (the autosave-draft handler of the web client), and because the vulnerability requires user interaction and changes scope, the script can execute in another user's browser session. By running code/actions in the security context of the victim's session, the attacker gains high-impact access to confidentiality, integrity, and availability (C:H/I:H/A:H per the CVSS vector). Organizations running ZCS 8.8.15 are affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-02-25 amid reported active exploitation, and EPSS is at 77.3% (100th percentile), though no public proof-of-concept is known.

Do: Upgrade ZCS 8.8.15 deployments to the latest available patch release per Synacor/Zimbra's instructions (or move to a supported release), as required by CISA's KEV listing and BOD 22-01 guidance for federal agencies. In the interim, restrict who can reach the /h/autoSaveDraft handler, review logs for suspicious POSTs to that endpoint and for injected drafts, and hunt for indicators of compromise such as unexpected mailbox rules or account activity.

Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' user can effectively coerce postfix into running arbitrary commands as 'root'.

CVE-2022-41352 is an unauthenticated arbitrary file upload flaw in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0, rooted in a path traversal weakness (CWE-22) in how the amavis mail scanner hands archives to the cpio utility. An attacker sends a specially crafted archive via email; cpio follows traversal entries and extracts attacker-controlled files into the web root at /opt/zimbra/jetty/webapps/zimbra/public. Uploaded files in that web-accessible directory can lead to remote code execution and incorrect access to other users' accounts, giving network-level attackers high impact on confidentiality, integrity, and availability (CVSS 9.8). Any ZCS 8.8.15 or 9.0 deployment that processes mail with cpio is affected, particularly on Red Hat/CentOS 7 and later where the pax utility (which Zimbra recommends as the safe alternative) is not installed by default. The flaw is actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-10-20 with known ransomware use, carries a 95.5% EPSS score, and public reporting ties Zimbra exploitation to campaigns including Russia-linked Sandworm/Seashell Blizzard access operations.

Do: Apply updates per vendor instructions, and as an immediate mitigation install the pax package on the Zimbra host (amavis automatically prefers pax over cpio once it is present; note pax is not in default Red Hat installations after RHEL/CentOS 6, while it is a prerequisite on Ubuntu). Also inspect /opt/zimbra/jetty/webapps/zimbra/public for unexpected uploaded files and review mail flow logs for suspicious archive attachments, given confirmed in-the-wild and ransomware-related exploitation.

CVE-2022-37042 is an authentication bypass combined with a ZIP archive path traversal (CWE-22) in the mboximport functionality of Synacor Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0, and it exists because of an incomplete fix for CVE-2022-27925. An attacker does not need a valid authtoken: by sending an attacker-crafted ZIP archive to the mboximport endpoint, the flaw lets arbitrary files be extracted and written outside the intended directory. Successful file-write primitives on a Zimbra server lead directly to remote code execution, with no privileges or user interaction required (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N). All internet-reachable ZCS 8.8.15 and 9.0 deployments are in scope, and the flaw has been added to CISA KEV (2022-08-11) with known ransomware use and a 91.9% EPSS exploitation probability. Exploitation is confirmed in the wild at scale: CISA ordered civilian agencies to patch after mass exploitation, and headlines attribute campaigns to both North Korean (No Pineapple) and Chinese state-sponsored (RedHotel) actors.

Do: Immediately apply the current ZCS 8.8.15 and 9.0 patch releases per Synacor/Zimbra vendor instructions, as required by CISA's KEV required action. Until patched, restrict or block unauthenticated access to the mboximport/service extension endpoint (e.g., via firewall or reverse proxy rules) and verify no authtoken-less requests have reached it. Hunt for unexpected files written by the mailbox process, review mailboxd/access logs for ZIP uploads lacking an authtoken, and check for follow-on webshell, lateral-movement, or ransomware artifacts given confirmed ransomware use.

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 pass unauthenticated network input to memcache without escaping, allowing a remote attacker to inject arbitrary memcache commands (CWE-74). By sending crafted requests to Zimbra's exposed web/mail services, an attacker can poison the cache and overwrite arbitrary cached entries — a high-severity integrity impact that, in reported campaigns, has been used to tamper with cached data and steal users' login credentials. Any organization running unpatched ZCS 8.8.15 or 9.0 is affected, including the enterprise, ISP, and government mail deployments that make up Zimbra's installed base. Exploitation is ongoing and widespread: the flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-08-04 after mass exploitation, with known ransomware use, and EPSS assigns an 85.4% probability of exploitation within 30 days (100th percentile).

Do: Apply the latest Zimbra patches for the 8.8.15 and 9.0 branches per the vendor's instructions, as required by CISA's KEV entry. As an interim mitigation, restrict memcache access (default TCP port 11211) so it cannot be reached through untrusted interfaces or the exposed mail/web services. Given known ransomware use, prioritize internet-facing Zimbra servers and review mail/web logs for signs of memcache command injection or cache tampering.

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (CWE-79) flaw with improper encoding/escaping (CWE-116) in its Calendar feature, allowing an attacker to execute arbitrary code. The flaw is triggered through the Calendar functionality, where attacker-supplied content is rendered without proper encoding, enabling script/code execution in the context of affected ZCS deployments. A successful attacker can execute arbitrary code in the targeted environment, and CISA notes known ransomware use in the wild. Organizations running Synacor ZCS are affected; the specific affected version ranges are not stated in the available data. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on 2022-02-25 with a 30.9% EPSS probability of exploitation within 30 days, though no public proof-of-concept is known.

Do: Apply updates per vendor instructions, as required by the CISA KEV listing. Because ransomware use is known, prioritize patching internet-facing ZCS servers, review Zimbra mailbox/Calendar logs for signs of malicious items or unauthorized access, and confirm users' sessions and accounts have not been compromised. Until patched, treat untrusted calendar invites as untrusted input and limit exposure of the ZCS web interface.

A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection.

An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature.

Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.

CVE-2020-7796 is a server-side request forgery (SSRF, CWE-918) in Synacor Zimbra Collaboration Suite (ZCS) versions before 8.8.15 Patch 7, rated critical at CVSS 9.8 with network reachability and no authentication or privileges required. The flaw is triggered when the WebEx zimlet is installed and zimlet JSP processing is enabled, allowing an unauthenticated remote attacker to make the Zimbra server issue attacker-controlled requests. Successful SSRF can let the attacker reach internal network services from the mail server's position (e.g., internal admin interfaces or other hosts behind the firewall), potentially leading to information disclosure or further compromise, and the CVSS vector indicates high impact to confidentiality, integrity, and availability. Any organization running a vulnerable Zimbra version with the WebEx zimlet present is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-17, confirming active exploitation, and it carries a very high EPSS score (84.4%, top percentile) amid a reported coordinated surge in SSRF exploitation activity.

Do: Upgrade Zimbra Collaboration Suite to 8.8.15 Patch 7 or later. If patching must be delayed, remove or disable the WebEx zimlet and disable zimlet JSP processing to eliminate the trigger; first check whether the WebEx zimlet is installed, since instances without it are not exposed to this specific flaw. As a KEV entry, federal agencies must apply vendor mitigations per BOD 22-01 (or discontinue use if unavailable), and all operators should review Zimbra logs for unauthenticated requests reaching zimlet JSP endpoints.

Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.

There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.