CVE-2022-27926: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
Published Apr 21, 2022 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Synacor vulnerabilities
All Synacor entriesCVE-2026-73570
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
high8.9ExploitedAug 13, 2026CVE-2025-66376
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
medium6.1ExploitedJan 5, 2026CVE-2025-68645
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
high8.8ExploitedDec 22, 2025CVE-2025-48700
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
medium6.1ExploitedJun 23, 2025CVE-2025-27915
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
medium5.4ExploitedMar 12, 2025CVE-2024-45519
Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
critical9.8ExploitedOct 2, 2024