CISA KEV · catalog date Apr 20, 2026 · first observed Jul 19, 2026
Evidence dossier
CVE-2025-48700
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1.
Exploited in the wild (CISA KEV since Apr 20, 2026). CISA-ADP reports CVSS 3.1 6.1. EPSS estimates 1.7% exploit likelihood as of Aug 27, 2026.
60.5–62.0Priority evidence range
As of Aug 27, 2026
Normalized restatement
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
- State
- PUBLISHED
- Published
- Jun 23, 2025
- Updated
- Apr 21, 2026
- Evidence coverage
- 99%
Evidence chronology
What was known when
- Source dateSource date omittedFirst observed by CASCACISA-ADPOriginal evidence ↗
Record text: CISA ADP Vulnrichment
Inspect raw assertion
- Field
container- Value
- CISA ADP Vulnrichment
- Source dateSource date omittedFirst observed by CASCAmitreOriginal evidence ↗
Record text: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
Inspect raw assertion
- Field
container- Value
- An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
- Source dateFirst observed by CASCACISA KEVOriginal evidence ↗
Exploitation cataloged: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Inspect raw assertion
- Field
observed_exploitation- Value
- Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- Source dateFirst observed by CASCAFIRST EPSSOriginal evidence ↗
EPSS score: 1.68% probability · 75.24th percentile
Inspect raw assertion
- Field
model_probability- Value
- Probability 0.016820000000; percentile 0.752420000000
FIRST EPSS · score date Aug 27, 2026 · 75.2th percentile · first observed Aug 27, 2026
CISA-ADP · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot
Evidence detail
Source limits and decisions
Why each evidence state has this value
Outside this view’s verified evidenceReason detail begins outside this selected snapshot; the state remains source-bound.
Source comparison
Who said what
CISA-ADPIndependent enrichment
Record text
CISA ADP Vulnrichment
Inspect raw assertion
- Field
container- Value
- CISA ADP Vulnrichment
mitreOriginal assertion
Record text
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
Inspect raw assertion
- Field
container- Value
- An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
CISA KEVOriginal assertion
Exploitation cataloged
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Inspect raw assertion
- Field
observed_exploitation- Value
- Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
FIRST EPSSOriginal assertion
EPSS score
1.68% probability · 75.24th percentile
Inspect raw assertion
- Field
model_probability- Value
- Probability 0.016820000000; percentile 0.752420000000
Applicability
Cited product scope
94Underlying assertions
1Canonical products
94Target assertions
0Constraint assertions
Grouped from 1 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.
Identity source boundaries
- Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z
27d65b0f-b718-4b4f-bb79-c47c68d09dfa - Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z
955dae73-7302-438b-aee1-058d7cc5d48e
2 scope groups
mitre · source assertedn/an/aDirect source scope
Affected: n/a
Source-reported scopeCanonical linkage remains open; the cited source assertion is retained below.
Inspect raw assertion
[{"status": "affected", "version": "n/a"}]NVD CPE · APPLICATIONsynacorzimbra_collaboration_suiteVulnerable target · 94 assertions
Any version (unconstrained) (>= 10.0.0, < 10.0.12); Any version (unconstrained) (>= 10.1.0, < 10.1.4); Version 8.8.15; Version 9.0.0Canonical identity
Scope supportedproduct-4e282fadbbcc212039ad71a0e7de43d3b9757c46bbe8fd5c086551b6c01bb56aLinked exactInspect raw assertions
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 89
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
52232aca-c158-48c8-a0db-7689040cb8fb
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 60
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
2b7d0a8b-7a72-4c1a-85f2-be336ca47e0b
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 31
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
89b3ef32-b474-44db-ae30-cd308cdc5a77
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 76
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
a82346a9-9cc2-4b91-ba2f-a815aaa92a7f
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 63
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
062e586f-0e02-45a6-93ad-895048fc2d4c
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 53
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
2e7c0a57-a887-4d29-b601-4275313f46b3
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 72
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
7991f602-41d7-4377-b888-d66a467ead67
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p43:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 41
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
5516ed19-5648-4bc8-a9c2-6ee41b1794c7
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 91
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
d2bb9bc7-078d-4e08-88e4-9432d74ca9ba
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 78
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
c7de1a7e-573b-42f3-b0a4-d2e676954fe0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 55
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
494f6fd4-36ed-4e40-8336-7f077fa80fa8
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 52
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
931bd98e-1a5f-4634-945b-bdd7d2faa8b0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 26
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
50fb0099-0495-4735-9398-7f7e657f459b
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 48
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
2c58afff-848f-490d-a95c-03a267c2dc98
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p46:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 44
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
8d93dabb-4e8b-4db4-bcd5-d495933d0223
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p37:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 34
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
518662da-c0f3-4875-86d7-5ed2b2496cc8
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 22
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
0294cb8b-b0af-4a5c-b6b2-33f5bfffbd4c
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 10
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
56558fd4-4391-4199-ba6b-b53f5dc30144
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 69
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
ab9e054b-7790-4e74-a771-40bf6ec71610
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 19
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
f211a8b1-e33e-49be-9c18-31b1902eb4fe
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p38:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 35
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
64b28be5-f35d-4ab0-a321-ceae21bc26ff
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 27
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
fae2858a-6d9e-4d79-afa6-69c44d6d8c75
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 64
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
3ee37bee-4bdb-4e62-8de3-98cf74dfbe01
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 18
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
9030d096-87a1-4aff-bb7c-ce71990005b3
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 73
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
2193fca2-1ae3-497d-b0ed-5b89727410e3
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p45:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 43
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
a00be897-f462-4193-bf51-4381b04c076b
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 5
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
7822d273-c2cb-4efe-b929-3d34c65e005e
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 67
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
40ab56b7-7222-4c44-a271-45dfe3673f72
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p36:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 33
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
37739f7a-490f-42a8-b97d-d09a3edb85dc
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 17
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
697a1d34-ff0c-4f9e-8e91-34404a366d70
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 81
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
aebe75f9-a494-4c78-927a-ea564bdcce0b
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 3
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
ffe7be6e-7a9a-40c7-b236-7a21103e9f41
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 77
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
2e800348-e139-418d-910b-7b3a9e1e721c
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 84
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
3cc9d046-4eb4-4608-8ab7-b60ac330a770
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 56
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
9df8c0ce-a71d-4bb1-83fb-1ea5ed77e0c9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 9
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
04becde0-f082-49fb-aca2-5c808902aa17
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 15
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
34b07279-a26a-4eb1-8b33-885ad854018b
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 83
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
5024fd58-a3ed-43b1-83ef-f4570c2573ba
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 12
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
3c0dce7f-85a4-44c6-88c8-380b0bbbfa7e
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 16
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
97402ada-ab05-4a92-920d-ea5363424fdf
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p42:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 88
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
205b2cdc-6423-4fd9-9fd0-847adeb64003
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 71
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
f43f4ac0-7c82-4cf4-b0c7-3a4c567bc985
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 82
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
900becba-7fdb-4e35-9603-29706fb87bd2
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 25
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
ef2ee32d-04a5-46ea-92f0-3c8d74a4b82a
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 49
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
b62dc188-89a8-4aea-90ae-563f0bbefc54
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 79
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
e60bc1d0-8552-4e6b-b2c5-96038448c238
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p40:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 38
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
0d2d6dbd-560a-4f8e-b2cc-67a564c460a3
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 30
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
c066ed38-1175-48fb-be05-be0c19e9ebe7
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 6
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
f81528e8-fe3a-4c48-a747-34a3ff28bcab
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 45
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
a9a1314a-20c8-42d7-9387-d914999eeaf6
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p42:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 40
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
d175fca2-f902-4470-bff6-5ec2f31bb06d
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 23
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
968a75b4-6d23-4b83-a8b5-777d8f151e04
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 50
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
32afce22-5ada-4ff7-a165-5ec12b325def
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 8
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
c2a468fe-b59b-4ce9-b9b2-c836eeafa3e8
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 58
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
24282ff8-548b-415b-95ca-1efd404d21d3
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 11
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
69a530d3-b84e-427b-bc92-64bbfef331be
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 24
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
5e11bc24-56a3-4cab-b0b2-d2430cd80767
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 21
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
9bc02b35-7fc4-41ab-8d2e-2cd1896d84c6
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 65
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
adf51bca-37dd-4642-b201-74a6d1a545ff
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 46
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
cef091c5-8dc6-4a41-9e84-f53be703f71b
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 14
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
6fcb5528-70fd-4525-a78b-d5537609331a
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 62
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
7e7b3976-da6f-4285-93e6-2328006f7f4d
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 90
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
3b4d0040-86d0-46c3-8a9a-3dd12138b9ed
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 28
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
5c1d9eb8-e3fe-4bf3-8517-603ba4b126c2
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 75
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
ff95618b-0bfb-403c-83be-c97879fc866d
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p35:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 32
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
a9eccb00-f3f4-4eb7-9fd0-4cb64678b129
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 13
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
180af8b6-55ae-460c-b613-37fb697b5325
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 57
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
e0648498-2ee5-4b68-8360-ed5914285356
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 4
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
b5924ffc-ba19-48b3-bf4d-0c2db3fcd407
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 29
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
50a296bc-6da4-41b2-923a-0633566ad6c1
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 20
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
4152cea2-9dc1-4567-bab3-9c36f74f77ea
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p44:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 42
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
28d5f229-ee33-42c4-a26d-23bc760720a5
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p41:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 39
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
bfbc20f8-7f50-4d9d-8442-3397ded4b18b
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 47
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
acd65c28-9716-4073-8613-c4af12684760
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 66
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
39611f3d-a898-4c35-8915-3334cdfb78e5
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 59
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
acfdf2d9-ed72-4969-aa3b-e8d48cb1922d
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p39:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 36
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
9dfbabd6-70f2-4e3b-a9c0-82de76d48542
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 7
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
d772d4ba-9ed6-492c-a0d3-0af4f3d49037
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 85
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
2af337b5-b296-449b-8848-7636ec7c46c5
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 86
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
a4535ec5-74d5-41e8-95f1-5c033adb043e
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 74
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
fa310afa-492d-4a6c-a7f6-740e82cb6e57
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 54
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
b7248b91-d136-4dd5-a631-737e4c220a02
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 93
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
992370fa-f171-4fb3-9c1c-58ac37038ce4
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 70
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
dd924e57-c77b-430b-a615-537bb39cea9c
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p41:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 87
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
408e1bfd-16aa-458c-b040-04870522febd
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 2
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
9e39a855-c0eb-4448-ae96-177757c40c66
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 80
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
3924251e-13b0-420e-8080-d3312c3d54af
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 61
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
019afc34-289e-4a01-b08b-a5807f7f909a
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 68
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
2ae8f501-4528-4f15-ae50-d4f11fb462de
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 51
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
d3577fe6-f1f4-4555-8d27-84d6de731ea3
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 92
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
f04d4b77-d386-4bc8-8169-9846693f6f11
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 1
- Logic
- OR
- Version bounds
- from including 10.1.0; through excluding 10.1.4
- Match ID
55361360-9f77-4731-82ad-82e65e4c5aa0
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 0
- Logic
- OR
- Version bounds
- from including 10.0.0; through excluding 10.0.12
- Match ID
e603bd7a-730e-410c-bbe1-3e5a8dd2a72f
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 37
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
bb3c28ca-4c22-423e-b1c7-cbafbb91f4db
Affected-product evidence
Accepted scope and product mapping
0 canonical links · 0 source-reported links
Applicability remains source-scoped; safety and exposure remain unassessed.
Assessments
CVSS by origin
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_match
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibility
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NEvidence boundaries
- KEV membership is authoritative for the catalog, not proof of exposure in any environment.
- EPSS is a dated model probability and not an individual-environment prediction.
- Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
- NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
- Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
- NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
- Affected-product evidence remains source-scoped; canonical linkage is required before applicability scoring.
- Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
- OSV aggregation and OSV-converted NVD material are not independent corroboration.
- Red Hat facts are vendor assertions for the exact supplied products.
- Nonmembership and not-yet-observed states are not proof of safety.