CVE-2022-27926

6.1 mediumKEVEPSS 18%

Medium (6.1) in Synacor Zimbra Collaboration Suite (ZCS). In CISA KEV since 2023-04-03. EPSS 18% chance of exploitation in the next 30 days.

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 18% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-11-01)
CISA KEV: listed 2023-04-03, due 2023-04-24
CWE: CWE-79
Published: 2022-04-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

synacor:zimbra_collaboration_suite

References

https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24

Check your stack JSON