CVE-2020-7796

CRITICAL9.8Published on February 18, 2020

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Feb 17, 2026
US federal agencies must remediate it by Mar 10, 2026 (BOD 22-01)
First attack observed 1392 days after disclosure
Confirmed by sensors, not only by reports

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Aug 19, 2026 Aug 18, 2026 Aug 16, 2026 Aug 14, 2026 Aug 12, 2026 Aug 10, 2026

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-918, CWE-918

Vendorssynacor

Affected products

Vendors	Prodotto	Versioni
synacor	zimbra collaboration suite	< 8.8.15

Zimbra, CVE-2026-73570 sfruttata in attacchi reali: chi deve aggiornare subito

Vulnerabilities

Zimbra CVE-2026-73570 Exploited in the Wild: Who Needs to Patch Immediately

CVE-2026-73570 in Zimbra Collaboration is actively exploited. Learn who needs to patch immediately, the vulnerability details, and security steps.

Aug 21, 20264 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

Zimbra CVE-2026-73570 Exploited in the Wild: Who Needs to Patch Immediately