CVE-2022-27926: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2023-04-03. EPSS: 17.6% chance of exploitation in the next 30 days.

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Affected products

• Synacor Zimbra Collaboration Suite: version 9.0.0 only

Published 2022-04-21. Last modified 2026-06-17.