Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2019-9670 · Published 29/05/2019 · updated 17/06/2026

Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/01/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
zimbra collaboration suite synacor	`= 8.7.11≥ 8.7.0, < 8.7.11`	`8.7.11`

Description

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

References

packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html · Exploit
rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce · Third Party Advisory
bugzilla.zimbra.com/show_bug.cgi · Broken Link
isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570 · Exploit
wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
exploit-db.com/exploits/46693 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2019-9670

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free