Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2022-04-21

CVE-2022-27926

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

  1. First cited attacker
  2. 1 day →First PoC

Signals

Exploited in the wild
Yesadded 2023-04-03 · due 2023-04-24. An observation, not a forecast.
EPSS · 30-day forecast
18%Chance of exploitation in the next 30 days, 97th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · MEDIUM
6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

1 known · links only

Nuclei1

  1. Zimbra Collaboration (ZCS) - Cross Site Scripting ↗

    A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

    yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.