Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV

CVE-2019-9670

  1. First PoC
  2. 2567 days →Metasploit
  3. 178 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2022-01-10 · due 2022-07-10. An observation, not a forecast.
EPSS · 30-day forecast
100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD
not stated by sourcesNo NVD record yet.
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

3 known · links only

Metasploit1

  1. Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF ↗

    This module exploits an XML external entity vulnerability and a server side request forgery to get unauthenticated code execution on Zimbra Collaboration Suite. The XML external entity vulnerability in the Autodiscover Servlet is used to read a Zimbra configuration file that contains an LDAP password for the 'zimbra' account. The zimbra credentials are then used to get a user authentication cookie with an AuthRequest message. Using the

    ruby · seen 2026-10-18

Exploit-DB1

  1. Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit) ↗

    created 2019-04-12

Nuclei1

  1. Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection ↗

    Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML external entity injection (XXE) vulnerability via the mailboxd component.

    yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.