Synacor's Zimbra Collaboration Suite (ZCS) had five separate vulnerabilities confirmed exploited and added to CISA's Known Exploited Vulnerabilities catalogue within roughly a seven-month span, ranging from a critical 2020 server-side request forgery bug to four newer cross-site scripting and file-inclusion flaws concentrated almost entirely in the Classic Web Client.
| CVE | CVSS | Flaw | Added to KEV |
|---|---|---|---|
| CVE-2020-7796 | 9.8 | SSRF via WebEx zimlet | 17 Feb 2026 |
| CVE-2025-68645 | 8.8 | Local file inclusion via /h/rest endpoint | 22 Jan 2026 |
| CVE-2025-66376 | 7.2 | Stored XSS via CSS @import | 18 Mar 2026 |
| CVE-2025-48700 | 6.1 | XSS via crafted HTML tags | 20 Apr 2026 |
| CVE-2025-27915 | 5.4 | Stored XSS via malicious ICS calendar file | 7 Oct 2025 |
Why the Classic Web Client keeps producing the same bug class
Three of these five findings — CVE-2025-27915, CVE-2025-66376, and CVE-2025-48700 — are cross-site scripting vulnerabilities that all trace back to the same root cause: Zimbra's Classic Web Client insufficiently sanitizes HTML content embedded in email messages before rendering it to the viewing user. CVE-2025-27915 exploits an ontoggle event inside a <details> tag hidden in a malicious ICS calendar attachment. CVE-2025-66376 abuses CSS @import directives inside HTML email. CVE-2025-48700's own NVD description separately calls out "crafted tag structures and attribute values that include an @import directive and other script injection vectors" — language nearly identical to CVE-2025-66376's, strongly suggesting these are variations on an incompletely patched sanitization gap rather than three unrelated discoveries. When a fix for one HTML-sanitization bypass in a webmail client is followed within months by a second and then a third bypass using a structurally similar technique, that is a signal the underlying sanitizer's allowlist approach is being probed and incrementally defeated by whoever is finding these bugs, not that Zimbra has three unrelated corners of insecure code.
The pattern matters because webmail XSS is a uniquely effective attack against exactly the population most likely to run self-hosted Zimbra: organizations that treat email as their primary business record and don't want it living in a hyperscaler's cloud. CVE-2025-27915's NVD entry documents the real payoff of this bug class explicitly — an attacker's injected JavaScript can silently set email filters to redirect a victim's incoming mail to an attacker-controlled address, turning a single opened calendar invite into a durable, self-refreshing surveillance channel over that mailbox that persists even after the initiating email is deleted.
The file inclusion and SSRF bugs point at server-side trust boundaries, not just the browser
CVE-2025-68645 is a different animal from the XSS trio: an unauthenticated attacker can craft a request to the /h/rest endpoint that manipulates Zimbra's internal request dispatching to include arbitrary files from the WebRoot directory — an LFI bug reachable with no login at all, which is why it carries the highest CVSS score in this cluster among the newer findings at 8.8. CVE-2020-7796, the oldest and most severe entry here at 9.8, is a server-side request forgery condition specific to installations with the WebEx zimlet enabled, letting an attacker pivot Zimbra's own server into making requests on their behalf against internal infrastructure the attacker couldn't otherwise reach.
What ties the whole cluster together is Zimbra's role as an email gateway with legitimate reasons to parse untrusted, attacker-supplied content — HTML mail bodies, ICS calendar invites, third-party zimlet integrations, REST API requests — and a long history of that parsing logic being the exact place where new bypasses keep surfacing. Five confirmed-exploited findings across a system built explicitly to process content nobody inside the organization has vetted is not surprising in isolation, but five in one KEV window on one product is worth treating as an ongoing trend rather than five closed tickets.
What to check this week
Patch to the versions referenced across all five advisories, not just the most recent one. The 2020 SSRF fix and the 2026 XSS fixes address entirely different code paths; catching up on the newest CVE doesn't retroactively close the older ones on an unpatched install.
Disable or tightly scope the WebEx zimlet if it isn't in active use, since CVE-2020-7796 only applies when that specific zimlet is installed and its JSP is enabled — the simplest fix here is removing the feature rather than patching around it.
Prioritize CVE-2025-68645 given it requires no authentication at all, in contrast to the XSS findings which generally require a user to view a crafted message — an unauthenticated LFI vector deserves faster remediation than bugs needing user interaction.
Audit mail filter rules across Zimbra mailboxes for unexpected forwarding or redirection rules, since CVE-2025-27915's documented technique specifically abuses XSS to silently plant these filters as a persistence mechanism.
A closing note on self-hosted email as a durable target
Organizations that run Zimbra specifically because they want email infrastructure outside major cloud providers are, by that same choice, taking on the patching burden a hyperscaler would otherwise absorb. Five confirmed-exploited CVEs in one window is the visible cost of that tradeoff, and it argues for a patch cadence on Zimbra that matches its exposure rather than one set by however often the IT team happens to review self-hosted infrastructure.
How Safeguard helps
Safeguard's continuous inventory tracks self-hosted messaging and collaboration platforms like Zimbra with the same rigor applied to internet-facing infrastructure generally, so a fifth confirmed-exploited finding against a product already patched four times in the same window surfaces immediately rather than waiting for the next scheduled review cycle.
