Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 7 Jul 2025.
Severity
High 7.5
Published
30 Apr 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.6.0, 8.7.11, 8.8.9
Exploit chance
81% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD
Affected software
Software
Affected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
Version 8.8.11-patch3
Version 8.8.11-patch2
Version 8.8.11-patch1
Version 8.8.11
All 48 release lines
Every version before 8.6.0
Version 8.6.0
Version 8.6.0-patch1
Version 8.6.0-patch2
Version 8.6.0-patch3
Version 8.6.0-patch4
Version 8.6.0-patch5
Version 8.6.0-patch6
Version 8.6.0-patch7
Version 8.6.0-patch8
Version 8.6.0-patch9
Version 8.6.0-patch10
Version 8.6.0-patch11
Version 8.6.0-patch12
From 8.7.0 before 8.7.11
Version 8.7.11
Version 8.7.11-patch1
Version 8.7.11-patch2
Version 8.7.11-patch3
Version 8.7.11-patch4
Version 8.7.11-patch5
Version 8.7.11-patch6
Version 8.7.11-patch7
Version 8.7.11-patch8
Version 8.7.11-patch9
Version 8.7.11-patch10
From 8.8.0 before 8.8.9
Version 8.8.9
Version 8.8.9-p5
Version 8.8.9-patch1
Version 8.8.9-patch2
Version 8.8.9-patch3
Version 8.8.9-patch4
Version 8.8.9-patch6
Version 8.8.9-patch7
Version 8.8.9-patch8
Version 8.8.9-patch9
Version 8.8.10
Version 8.8.10-patch1
Version 8.8.10-patch2
Version 8.8.10-patch3
Version 8.8.10-patch4
Version 8.8.10-patch6
Version 8.8.10-patch7
Version 8.8.11
Version 8.8.11-patch1
Version 8.8.11-patch2
Version 8.8.11-patch3
Known exploited
CISA name
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.