Zimbra Collaboration Suite (ZCS) WebEx Zimlet SSRF Vulnerability (CVE-2020-7796) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTZimbra Collaboration Suite (ZCS) versions prior to 8.8.15 Patch 7 with WebEx zimlet installed and zimlet JSP enabled
Unauthenticated remote attackers can exploit Server-Side Request Forgery (SSRF) to access internal network resources, extract sensitive data, or pivot to further remote code execution (RCE)
Immediately upgrade Zimbra Collaboration Suite to 8.8.15 Patch 7 or later, or disable and undeploy the unused WebEx zimlet
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
To apply the official security patch, upgrade your system to Zimbra 8.8.15 Patch 7 or later using the following commands.
# For RedHat/CentOS systems
yum clean all
yum update zimbra-patch
# For Ubuntu/Debian systems
apt-get update
apt-get --only-upgrade install zimbra-patch
# Restart Zimbra services (run as zimbra user)
su - zimbra -c 'zmcontrol restart'2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, mitigate the risk by disabling and undeploying the vulnerable WebEx Zimlet.
# Switch to zimbra user
su - zimbra
# Disable the WebEx zimlet
zmzimletctl disable com_zimbra_webex
# Undeploy the WebEx zimlet completely
zmzimletctl undeploy com_zimbra_webex
# Restart the mailbox service to apply changes
zmmboxdctl restart3. Log Audit & IoC Verification Commands
Verify the status of the WebEx Zimlet and inspect logs for potential SSRF exploitation attempts.
# Check if WebEx Zimlet is installed and active
su - zimbra -c 'zmzimletctl listZimlets' | grep webex
# Search for WebEx JSP execution and suspicious external URL patterns in logs
grep -i 'webex' /opt/zimbra/log/mailbox.log
grep -i 'zimlet' /opt/zimbra/log/access_log* | grep -E '(http|https)://'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-7796) is a Server-Side Request Forgery (SSRF, CWE-918) in the WebEx Zimlet component of Zimbra Collaboration Suite (ZCS). It occurs due to insufficient input validation and sanitization when processing external requests through the WebEx Zimlet when Zimlet JSP is enabled. This allows an attacker to force the Zimbra server to initiate arbitrary HTTP requests to internal or external IP addresses.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker crafts and sends a malicious HTTP request targeting specific JSP endpoints within the WebEx Zimlet. Since the Zimbra server typically resides in a trusted internal network zone, the attacker leverages this trusted position to query internal metadata services (e.g., AWS IMDSv1/v2, GCP metadata), internal databases, or LDAP directory services that are otherwise inaccessible from the public internet. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.
3. Infrastructure & Business Impact
Successful exploitation of this vulnerability can lead to internal network reconnaissance, credential theft from cloud metadata endpoints, and unauthorized access to sensitive internal services. This can serve as an entry point for lateral movement, leading to full compromise of the mail server, data exfiltration, and severe business disruption.
Official Vendor Advisories & References
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
Frequently Asked SecOps Questions (CVE-2020-7796)
FAQQ1. How critical is CVE-2020-7796 and is it actively exploited in the wild?
CVE-2020-7796 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 93.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-7796?
Primary impacted vendors include zimbra across zimbra collaboration suite. Scope summary: Zimbra Collaboration Suite (ZCS) versions prior to 8.8.15 Patch 7 (with WebEx zimlet installed and JSP enabled)
Q3. What temporary mitigations or workarounds exist for CVE-2020-7796 before patching?
[Mitigation] Immediately upgrade Zimbra Collaboration Suite to 8.8.15 Patch 7 or later, or disable and undeploy the unused WebEx zimlet Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-7796
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (zimbra)
View Category →Zimbra Collaboration Suite (ZCS) Remote Code Execution Vulnerability Advisory (CVE-2026-73570, CISA KEV Listed)
[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
Plex Media Server SSRF Vulnerability Advisory (CVE-2026-96655)
[Affected Scope] All Plex Media Server installations prior to version 1.43.3.10861
Plex Media Server SSRF Vulnerability Advisory (CVE-2026-96652) - Internal Network Pivoting and Request Forgery
[Affected Scope] All Plex Media Server installations prior to version 1.43.3.10861.
Campfire SSRF Vulnerability Advisory (CVE-2026-100355): Internal Network Guard Bypass
[Affected Scope] All environments running Campfire version 1.4.4 and earlier.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.