---
id: "CVE-2020-7796"
kind: "vulnerability"
aliases: ["CVE-2020-7796"]
title: "synacor zimbra collaboration suite: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "synacor zimbra collaboration suite", "fixed": ["8.8.15"], "affected": "< 8.8.15", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 8.8.15", "ecosystem": "vendor"}, {"name": "Synacor Zimbra Collaboration Suite", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["email", "exploited", "package", "self-hosted", "zimbra"]
not_affected_if: ["webex-zimlet-not-installed", "zimlet-jsp-disabled"]
published_at: "2020-02-18T22:15:10+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-7796", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7796", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# synacor zimbra collaboration suite: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is…

Zimbra Collaboration Suite has a server-side request forgery flaw in its WebEx zimlet when the zimlet JSP is enabled. An attacker can make the Zimbra server send requests to hosts it can reach, such as internal services, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:synacor zimbra collaboration suite affected < 8.8.15 fixed 8.8.15
- vendor:synacor zimbra collaboration suite affected = 8.8.15 fixed ?
- vendor:Synacor Zimbra Collaboration Suite affected ? fixed ?

## Fix

Apply the vendor mitigations per CISA guidance; the specific patched version is unknown from the sources.
If mitigations are unavailable, discontinue use of the product per CISA required action.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-7796
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-7796

## From the sources

Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_