Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-07-07
• EPSS: 81% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 28 Jul 2025): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-Prox…ExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.htmlExploitThird Party AdvisoryVDB Entry
• www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rceExploitThird Party Advisory
• blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.htmlThird Party Advisory
• blog.zimbra.com/2019/03/9826Vendor Advisory
• bugzilla.zimbra.com/show_bug.cgiIssue Tracking
• wiki.zimbra.com/wiki/Security_CenterRelease NotesVendor Advisory
• wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
• www.exploit-db.com/exploits/46693ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource