How critical is CVE-2020-7796?

CVE-2020-7796 is rated 9.8 Critical on the CVSS v3.1 scale. It allows an unauthenticated remote attacker to exploit an SSRF vulnerability in Zimbra's ProxyServlet, potentially leading to access to internal services and arbitrary code execution on the server.

What versions of Zimbra are affected by CVE-2020-7796?

Zimbra Collaboration Suite versions before 8.8.15 Patch 7 and ZCS 9.0.0 versions before Patch 2 are affected. Both open-source and commercial editions contain the vulnerable ProxyServlet component.

Can CVE-2020-7796 be exploited without authentication?

Yes. The vulnerability requires no authentication (PR:N), no user interaction (UI:N), and has low attack complexity (AC:L). An attacker only needs network access to the Zimbra server's web interface to exploit the SSRF in ProxyServlet.

Is CVE-2020-7796 being actively exploited?

Yes. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, and it has an EPSS score of 0.66284 (98.44th percentile), indicating that exploitation is extremely widespread. Multiple Zimbra vulnerabilities have been actively targeted by threat actors in recent years.

What should I do if my Zimbra server was unpatched?

If your Zimbra instance was running an unpatched version, assume potential compromise. After applying the patch, conduct a thorough security audit including checking for web shells, reviewing mailbox access logs, auditing user account changes, and inspecting server filesystem integrity. Consider engaging incident response support for critical environments.

CVE-2020-7796

CRITICAL(9.8)KEVLikely Exploited

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

Description

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

KEV Information

Vendor

Synacor

Product

Zimbra Collaboration Suite

Date Added

February 17, 2026

Due Date

March 10, 2026

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CWEs

CWE-918SSRF

Server-Side Request Forgery (SSRF)

Affected Products

Vendor	Product	Version
synacor	zimbra collaboration suite	< 8.8.15; 8.8.15

Multiple CVSS Assessments

Source: [email protected](Primary)

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7(Release Notes, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7796(US Government Resource)

CVSS Score

9.8

CRITICAL(9.8)

EPSS Score

EPSS Score84.42%

EPSS Percentile99.7%

Dates

PublishedFebruary 18, 2020

Last ModifiedJune 17, 2026

StatusAnalyzed

CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch

CVE-2020-7796

Description

KEV Information

CVSS Score

CWEs

Affected Products

Multiple CVSS Assessments

References

CVSS Score

EPSS Score

Dates

Quick Links

Need Help With Vulnerability Management?

Platform

Resources

Company

Latest Articles