CVE-2020-7796
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
Published Feb 18, 2020 · updated Jun 16, 2026 · Synacor Zimbra Collaboration Suite
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.
Timeline
Detection, updates, and resolution for this record.
Feb 18, 2020 · Catalog
Detected
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.
Feb 17, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Mar 10, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Mar 10, 2026
Affected
- cpe synacor/zimbra collaboration suiteversion unspecified
- cpe synacor/zimbra collaboration suite8.8.15
- vendor Synacor Zimbra Collaboration Suiteversion unspecified
Sources
- CISA KEVCVE-2020-7796
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.
cisa.gov - CVE.orgCVE-2020-7796
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-7796
30-day exploitation probability 84.4%
first.org - NIST NVDCVE-2020-7796
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
nvd.nist.gov