CVE-2019-9621
Published 2019-04-30 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2019-9621 is a high-severity (CVSS 7.5) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). CISA added it to the Known Exploited Vulnerabilities catalog on July 7, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 28, 2025. CISA does not currently list it as used in ransomware campaigns. Synacor has 19 vulnerabilities in the KEV catalog, 6 of them linked to ransomware.
All 19 known-exploited Synacor vulnerabilities →Description
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: Synacor — Zimbra Collaboration Suite (ZCS)
Name: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Date added: 2025-07-07 · Due: 2025-07-28
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
- http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
- https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html
- https://blog.zimbra.com/2019/03/9826/
- https://bugzilla.zimbra.com/show_bug.cgi?id=109127
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories