CVE-2022-27926
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Published Apr 20, 2022 · updated Jun 16, 2026 · synacor zimbra collaboration suite
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
Timeline
Detection, updates, and resolution for this record.
Apr 20, 2022 · Catalog
Detected
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
Apr 3, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 24, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
Required action
Apply updates per vendor instructions.
CISA due date Apr 24, 2023
Affected
- cpe synacor/zimbra collaboration suite9.0.0
- vendor Synacor Zimbra Collaboration Suite (ZCS)version unspecified
Sources
- CISA KEVCVE-2022-27926
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.
cisa.gov - CVE.orgCVE-2022-27926
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-27926
30-day exploitation probability 17.6%
first.org - NIST NVDCVE-2022-27926
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
nvd.nist.gov