BLACKOUT MAP

Synacor · Zimbra Collaboration Suite

CVE-2020-7796

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 94%
Share

What it is

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: March 10, 2026

Added to the CISA list
February 17, 2026
Published
February 18, 2020
Severity
Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS)
94% in the top 0.2% of all known vulnerabilities
Weakness
CWE-918
More details
NVD · CVE.org · CISA
All references (1)

More exploited flaws from Synacor

AddedVulnerabilityProductSeverityAttack chance
Aug 21, 2026OS Command InjectionCVE-2026-73570Zimbra Collaboration Suite (ZCS)High 8.972%
Apr 20, 2026Cross-site ScriptingCVE-2025-48700Zimbra Collaboration Suite (ZCS)Medium 6.11.7%
Mar 18, 2026Cross-Site ScriptingCVE-2025-66376Zimbra Collaboration Suite (ZCS)High 7.220%
Jan 22, 2026Zimbra Collaboration Suite (ZCS) PHP Remote File InclusionCVE-2025-68645 Zimbra Collaboration Suite (ZCS)High 8.849%
Oct 7, 2025Cross-site ScriptingCVE-2025-27915Zimbra Collaboration Suite (ZCS)Medium 5.44.1%
Jul 7, 2025Server-Side Request Forgery (SSRF)CVE-2019-9621Zimbra Collaboration Suite (ZCS)High 7.581%
May 19, 2025Cross-Site Scripting (XSS)CVE-2024-27443Zimbra Collaboration Suite (ZCS)Medium 6.125%
Feb 25, 2025Cross-Site Scripting (XSS)CVE-2023-34192Zimbra Collaboration Suite (ZCS)Critical 9.077%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.