CVE-2022-27926: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: yes — in CISA KEV since 2023-04-03
EPSS: 17.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-21 · updated 2026-06-17
Weakness: CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Summary

CVE-2022-27926 is a reflected cross-site scripting (XSS) flaw in the /public/launchNewWindow.jsp component of Synacor Zimbra Collaboration Suite (ZCS) 9.0. Unauthenticated attackers can execute arbitrary web script or HTML via request parameters, impacting users of ZCS 9.0. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and a public exploit or detection template exists. Apply updates per vendor instructions to mitigate.

CVE-2022-27926 هو ثغرة XSS منعكسة في مكون /public/launchNewWindow.jsp في Synacor Zimbra Collaboration Suite (ZCS) 9.0. يمكن للمهاجمين غير المصادقين تنفيذ نصوص ويب أو HTML عشوائية عبر معاملات الطلب، مما يؤثر على مستخدمي ZCS 9.0. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة المستغلة مع استغلال نشط، ويوجد استغلال عام أو قالب كشف. طبق التحديثات وفقًا لتعليمات البائع للتخفيف.

Affected products

Zimbra Collaboration: 9.0.0, 9.0.0-p1, 9.0.0-p10, 9.0.0-p11, 9.0.0-p12, 9.0.0-p13 (+18)

References

Get alerted when CVE-2022-27926 or the next vulnerability affects your stack