Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

HIGH 7.5EXPLOITED (CISA KEV)CVE-2019-9621 · Published 30/04/2019 · updated 17/06/2026

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 07/07/2025. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
zimbra collaboration suite synacor	`= 8.6.0= 8.7.11= 8.8.10= 8.8.11= 8.8.9≥ 8.7.0, < 8.7.11≥ 8.8.0, < 8.8.9< 8.6.0`	`8.7.118.8.98.6.0`

Description

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

References

packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html · Exploit
packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html · Exploit
rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce · Exploit
blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html · Third Party Advisory
blog.zimbra.com/2019/03/9826 · Vendor Advisory
bugzilla.zimbra.com/show_bug.cgi · Issue Tracking
wiki.zimbra.com/wiki/Security_Center · Release Notes
wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
exploit-db.com/exploits/46693 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2019-9621

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free