CVE-2022-27926Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

6.1 MEDIUMEPSS 17.63%⚡ Known Exploited (CISA KEV)NVD: Published

Last updated: 2025-10-21 23:15 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
6.1	MEDIUM	3.1CISA-ADP	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CVE ID: CVE-2022-27926
Status: Published
Assigner (CNA): mitre
Published: Apr 20, 2022
Last modified: 2025-10-21 23:15 UTC
Weaknesses: CWE-79
CWE-138

Sources

NVD (unavailable at last refresh)
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 14:27 UTC.