Back to CVE Browser

CVE-2022-27926

🔥 Known Exploited (CISA KEV)MEDIUM

6.1

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2022-04-21

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Affected Platforms (CPE)

📦

Synacor

Zimbra Collaboration Suite

= 9.0.0

References & Advisories

🔗 https://wiki.zimbra.com/wiki/Security_Center

🔗 https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24

🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

🔗 https://wiki.zimbra.com/wiki/Security_Center

🔗 https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24

🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27926

Related Vulnerabilities

CVE-2026-611427.7

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that ...

CVE-2026-611417.5

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Affordable Care Act). Supported vers...

CVE-2026-611387.5

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Opera...

CVE-2026-611257.7

Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Support...