Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

MEDIUM 6.1EXPLOITED (CISA KEV)CVE-2022-27926 · Published 21/04/2022 · updated 17/06/2026

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/04/2023. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
zimbra collaboration suite synacor	`= 9.0.0`	No fix yet

Description

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

References

wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24 · Release Notes
wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2022-27926

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free