DaystoPatch

Zimbra (Synacor)Exploited incident

Zimbra WebEx zimlet server-side request forgery (CVE-2020-7796)

CVE-2020-7796Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 17 Feb 2026

  • Exploited after a fix existed
FixedA fix existed when the bug went public. No evidence yet of when every version was fixed.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
not dated
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS Patch 7 was released on Feb 10, 2020.

    Security Center entry 'ZCS 8.8.15 Patch 7 released', listing 'CVE-2020-7796 - Potential for SSRF if WebEx zimlet installed and zimlet JSP enabled.' Added 2026-10-23 (R2): the patch was out two days before the blog announcement.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    Zimbra blog: Zimbra 8.8.15 'James Prescott Joule' Patch 7CuratedQuote verified12 Feb 2020

    By Urvi Mehta on February 12, 2020

    Coordinated disclosure: the patch announcement (security fixes table lists 'Potential for SSRF if WebEx zimlet installed and zimlet JSP enabled', CVE-2020-7796, fixed in 8.8.15 P7) was the first public information; the CVE record followed on 2020-02-18.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ca3accc8bc217171…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2020-7796ClaimedQuote verified18 Feb 2020, 21:14 UTC

    Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7048c93c223299e5…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2020-7796)ClaimedQuote verified17 Feb 2026

    Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

    Added to CISA's KEV catalog on 2026-02-17.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet17 Feb 2026, 21:24 UTC

    CVE-2020-7796 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    CVE-2020-7796 - Potential for SSRF if WebEx zimlet installed and zimlet JSP enabled.

    Entry for 8.8.15 Patch 7, released Feb 10, 2020.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Zimbra blog: Zimbra 8.8.15 'James Prescott Joule' Patch 7CuratedQuote verified12 Feb 2020

    By Urvi Mehta on February 12, 2020

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ca3accc8bc217171…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS Patch 7 was released on Feb 10, 2020.

    R2: release date of the fixed build (8.8.15 Patch 7).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Zimbra blog: Zimbra 8.8.15 'James Prescott Joule' Patch 7CuratedQuote verified12 Feb 2020

    Potential for SSRF if WebEx zimlet installed and zimlet JSP enabled

    Row in the post's Security Fixes table: CVE-2020-7796, fix patch version 8.8.15 P7; post dated 2020-02-12.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ca3accc8bc217171…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    No evidence yet of fixed releases for every supported branch.

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Zimbra Collaboration Suite before 8.8.15 Patch 7 with the WebEx zimlet installed and zimlet JSP enabled
How we built this timeline

Old bug fixed in 8.8.15 Patch 7 (12 Feb 2020), KEV-listed 17 Feb 2026. No public report of exploitation before the fix was found.

Fixed for all versions is omitted: Zimbra and the CVE record name only the 8.8.15 Patch 7 fix, and which other branches were supported and affected in February 2020 (e.g. 8.8.12, 8.7.11) was not established. CVSS 9.8 is the CISA-ADP score in the CVE record (Zimbra gave none).

Zimbra's current advisories table does not list this CVE. Correction pass 23 Oct 2026 (R2): the Security Center gives the 8.8.15 Patch 7 release date as 10 Feb 2020, two days before the blog post (12 Feb 2020) previously used; world, vendor and First fix now start on 10 Feb 2020 (the blog-post candidates are kept).

Related

No related incidents.

Zimbra (Synacor) report card