CVE-2022-27926: Zimbra Collaboration reflected XSS, exploited by nation-state actors
The short version: CVE-2022-27926 is a reflected cross-site scripting (XSS) flaw in Zimbra Collaboration Suite 9.0.0. A crafted link to a vulnerable webmail server runs attacker-controlled JavaScript in the victim's browser — enough to steal a webmail session and read mail. It's in CISA's KEV catalog and was used by nation-state crews against government targets. Steady hands: patch to 9.0.0 P24 and keep webmail off the open internet where you can.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — in practice (see below) |
| CVSS v3.1 (NVD) | 6.1 — Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 17.6% · 96.8th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-04-24 |
| Known exploited? | Yes — used by Winter Vivern / TA473 against NATO-aligned government organizations |
| Vulnerability type | CWE-79 reflected cross-site scripting → script execution in the victim's webmail session |
| Requires authenticated session? | No — but it requires the victim to click a crafted link (UI:R) |
| Affected | Zimbra Collaboration Suite 9.0.0 (through patch 23) |
| Fixed in | Zimbra Collaboration Suite 9.0.0 Patch 24 |
What you need to know
Zimbra Collaboration is a webmail and collaboration platform, and its login and public endpoints are meant to be reachable by users on the internet. CVE-2022-27926 is a reflected XSS in a public endpoint: input supplied in a request parameter is echoed back into the page without proper sanitization, so an attacker who gets a victim to open a crafted URL can run JavaScript in that victim's browser, in the context of the Zimbra site.
On a webmail server, that context is the prize:
- How they use it — attackers hyperlink a benign-looking URL in a phishing email that actually points at the victim's own vulnerable Zimbra host with an XSS payload appended.
- What it leads to — script running in an authenticated webmail session can lift the session identifier, scrape mailbox contents, or quietly change account settings. That's credential and mail theft without ever cracking a password.
- Who used it — this was not theoretical. The espionage group tracked as Winter Vivern (TA473) exploited it against NATO-aligned government email systems, which is why it sits in CISA's KEV catalog.
How serious we see it
Moderate — above the 6.1 Medium base score, and here's the honest reasoning for the gap.
CVSS scores this a 6.1 largely because it needs user interaction (someone has to click) and the direct impact is "only" script execution. But the target changes the calculus: this is webmail, the payload steals live sessions and mailbox data, and it was actively used by a capable actor against real government targets. When a Medium-band XSS is a working front door to government email, we rate it by what it did, not by the metric box it lands in.
The bounded, reassuring part: it affects a specific Zimbra version, the fix is a straightforward patch, and you can quickly determine whether you run an exposed, affected instance.
Recommendations
Straight from Zimbra's release guidance and CISA:
- Patch now. Upgrade to Zimbra Collaboration Suite 9.0.0 Patch 24 or later.
- Reduce webmail exposure. Where practical, restrict public-facing webmail portals so they aren't reachable by the whole internet — it blunts reconnaissance and drive-by phishing links.
- Hunt for prior use. Review webmail access logs for anomalous sessions and for requests carrying script payloads in parameters; check for unexpected mailbox rule or setting changes.
- If you find evidence of compromise, respond. Invalidate sessions and reset affected users' credentials.
- Confirm your exposure first. Verify whether you run an internet-facing Zimbra 9.0.0 instance below patch 24.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing Zimbra webmail interfaces, fingerprints the version, and flags exposure tied to this KEV-listed flaw so it rises to the top of your results instead of getting lost in a scanner backlog. Where verification is enabled, it goes a safe step further than a scanner: it sends a single benign request to the affected endpoint and checks whether the input is reflected back — confirming the exposure actually holds rather than flagging a maybe.
That continuous, attacker's-eye view is the point: a webmail flaw that nation-state crews were already using was surfaced as a confirmed finding, ranked by real-world impact.