CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Zimbra Collaboration Suite (ZCS) Remote Code Execution Vulnerability Advisory (CVE-2026-73570, CISA KEV Listed)
[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands as the Zimbra user by sending specially crafted SMTP requests.
[Mitigation] Immediately upgrade Zimbra Collaboration to version 10.1.20 or later, or temporarily disable the zimbra-snmp service.
Zimbra Collaboration Suite (ZCS) CalendarInvite Header Input Validation Vulnerability leading to Cross-Site Scripting (CVE-2024-27443)
[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0 and 10.0 utilizing the classic webmail user interface.
[Impact] Successful exploitation allows remote attackers to execute arbitrary JavaScript code in the context of the victim's browser session, potentially leading to session hijacking and unauthorized data access.
[Mitigation] Apply official security patches (9.0.0 Patch 39, 10.0.7 or higher) immediately, or restrict access to the classic UI.
Zimbra Collaboration Suite (ZCS) 8.8.15 Stored XSS Vulnerability Leading to Remote Code Execution (CVE-2023-34192) Security Advisory
[Affected Scope] Zimbra Collaboration Suite (ZCS) version 8.8.15
[Impact] A remote authenticated attacker can execute arbitrary code and hijack sessions by injecting malicious scripts into the '/h/autoSaveDraft' function
[Mitigation] Immediately apply the official Zimbra security patches and restrict access to the affected endpoint using WAF rules
Zimbra Collaboration Suite (ZCS) 9.0 Reflected Cross-Site Scripting (XSS) Vulnerability (CVE-2022-27926) Analysis and Mitigation Guide
[Affected Scope] Zimbra Collaboration Suite (ZCS) 9.0.0 versions prior to Patch 24
[Impact] Unauthenticated attackers can execute arbitrary web scripts or HTML in the victim's browser session, potentially hijacking active sessions and accessing sensitive mailboxes
[Mitigation] Immediately upgrade to Zimbra 9.0.0 Patch 24 or later, and apply temporary WAF rules to block access to the vulnerable endpoint
Zimbra Collaboration Suite (ZCS) Memcached Command Injection Vulnerability (CVE-2022-27924) Security Advisory
[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0.
[Impact] Unauthenticated remote attackers can inject arbitrary Memcached commands, leading to cache poisoning, session hijacking, and credential theft.
[Mitigation] Immediately apply the official Zimbra security patches (9.0.0 Patch 24 / 8.8.15 Patch 31 or higher).