Zimbra (Synacor)Exploited incident
Zimbra ProxyServlet server-side request forgery used in pre-auth RCE chains (CVE-2019-9621)
CVE-2019-9621Medium, CVSS 4.0In CISA's Known Exploited Vulnerabilities catalog since 7 Jul 2025
- Exploited after a fix existed
Response
- Silence
- 19d First public report to first vendor statement
- Exposure
- 19d First public report to first fix
- Follow-through
- 33d First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
date only
An Trinh: A Saga of Code Executions on ZimbraCuratedQuote verified
2. SSRF to the rescue - CVE-2019-9621
Researcher write-up dated March 13, 2019 that names CVE-2019-9621 and shows how the ProxyServlet SSRF fits a pre-auth RCE chain, before any Zimbra fix for this CVE existed (first fix 8.8.12 on 2019-04-01). It suggests blocking '/service/proxy*' as a workaround.
- Source
- An Trinh: A Saga of Code Executions on Zimbra research
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:e089d05b09cb6718…- Used in metrics
- Yes
3 more sources for this moment
CVE.org record CVE-2019-9621ClaimedQuote verified30 Apr 2019, 17:40 UTC
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
CVE record published.
- Source
- CVE.org record CVE-2019-9621 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:50da62942319af0f…- Used in metrics
- No, kept for the record
CISA KEV (CVE-2019-9621)ClaimedQuote verified7 Jul 2025
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Added to CISA's KEV catalog on 2025-07-07.
- Source
- CISA KEV (CVE-2019-9621) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet7 Jul 2025, 17:15 UTC
CVE-2019-9621
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Vendor statement
date only+19d
Zimbra Security Center (Wayback snapshot)CuratedQuote verified
ZCS 8.8.12 was released on April 1, 2019
The Security Center entry (posted 'April 3, 2019') lists 'CVE-2019-9621 / Bug 109127 - SSRF (CWE-918 CWE-807)' among the 8.8.12 security fixes. No earlier public Zimbra statement on this CVE was found.
- Source
- Zimbra Security Center (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:c12fa055432dba11…- Used in metrics
- Yes
First workaround
No official mitigation found yet.
First fix
date only+19d
Zimbra Security Center (Wayback snapshot)CuratedQuote verified
ZCS 8.8.12 was released on April 1, 2019
8.8.12 GA included the fix.
- Source
- Zimbra Security Center (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:c12fa055432dba11…- Used in metrics
- Yes
Fixed for all versions
date only+33d
Zimbra Security Center (Wayback snapshot)CuratedQuote verified
were released on April 15, 2019. The releases includes security fixes for:
Entry 'ZCS 8.7.11 Patch 11, 8.8.9 Patch 10, 8.8.10 Patch 8 and 8.8.11 Patch 4 were released on April 15, 2019', listing 'CVE-2019-9621 / Bug 109127 - SSRF'. Re-quoted 2026-10-23: the version names are links, so the quote starts after them. wiki.zimbra.com was in maintenance, so a Wayback capture is cited.
- Source
- Zimbra Security Center (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:c12fa055432dba11…- Used in metrics
- Yes
Send this to your boss
No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.
Affected products
- Zimbra Collaboration Suite 8.7.11 before Patch 11, 8.8.9 before Patch 10, 8.8.10 before Patch 8, 8.8.11 before Patch 4, and before 8.8.12
How we built this timeline
Old bug (KEV 7 Jul 2025) with a public disclosure before the fix: An Trinh's blog of 13 Mar 2019 described the SSRF 19 days before 8.8.12 and 33 days before the branch patches. exploited before a fix=false under R4 (was null before the 23 Oct 2026 correction pass): the first fix (8.8.12, 1 Apr 2019) was public before the earliest public evidence of exploitation. A commenter on that blog reported a compromise on 2 Apr 2019 traced through 'XXE in Autodiscover.xml' (a different CVE), and the author's '30/04' edit says the Autodiscover XXE and ProxyServlet SSRF 'seem to be actively exploited', both after the first fix; no report of SSRF exploitation before 1 Apr 2019 was found.
The CVE record (published 30 Apr 2019) gives slightly different fixed-patch numbers ('8.7.x before 8.7.11 patch 10, ... 8.8.x before 8.8.11 patch 3') than Zimbra's Security Center; Zimbra's own list is used.
Severity uses Zimbra's own score (CVSS 4.0, 'Minor'); the CISA-ADP score in the CVE record is 7.5. Audit-2 T2 re-check (23 Oct 2026): false stands.
No retrospective report was found that dates SSRF exploitation before the first fix (8.8.12, 1 Apr 2019). On An Trinh's post, comments from 18 Mar 2019 to 03-31 contain only questions; the first compromise report is 2 Apr 2019 and points to the Autodiscover XXE (CVE-2019-9670); the author's '30/04' edit says the SSRF 'seem[s] to be actively exploited'.
CISA's KEV listing (7 Jul 2025) and HKCERT's 8 Jul 2025 bulletin concern recent exploitation. Searched: web and news for 2019 campaign reports, SANS ISC, Metasploit module write-ups, HKCERT and CVE aggregators;
Zimbra's forums were offline (maintenance) on 22 Oct 2026/23.
Related
No related incidents.