CVE-2022-27926

Medium6.1Published on April 20, 2022

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Apr 3, 2023
US federal agencies must remediate it by Apr 24, 2023 (BOD 22-01)
First attack observed 343 days after disclosure
Confirmed by sensors, not only by reports

Apply updates per vendor instructions.

Source: CISA KEV · Feb 2, 2026 Jun 12, 2025 May 1, 2024 Feb 17, 2024 Aug 17, 2023 Aug 10, 2023

CVSS score6.1 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness type (CWE)CWE-79, CWE-79

Vendorssynacor

Affected products

Vendors	Product	Versions
synacor	zimbra collaboration suite	9.0.0

Vulnerabilities

Zimbra CVE-2026-73570 Exploited in the Wild: Who Needs to Patch Immediately

CVE-2026-73570 in Zimbra Collaboration is actively exploited. Learn who needs to patch immediately, the vulnerability details, and security steps.

Aug 20, 202623:094 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

Zimbra CVE-2026-73570 Exploited in the Wild: Who Needs to Patch Immediately