CVE-2023-34192: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2025-02-25. EPSS: 77.3% chance of exploitation in the next 30 days.

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

Affected products

• Synacor Zimbra Collaboration Suite: version 8.8.15 only

Published 2023-07-06. Last modified 2026-06-17.