# CVE-2022-27926

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

- Page: https://www.vulneraibility.com/cve/CVE-2022-27926
- CVSS: 6.1
- Known exploited: yes, in CISA KEV since 2023-04-03; CISA due date 2023-04-24
- EPSS: 17.63% (percentile 97.2)
- Detection templates only, no public exploit found: 1 Nuclei template
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-01-29)
- Weakness: CWE-79
- Published: 2022-04-21

## Affected

- synacor:zimbra_collaboration_suite

## References

- [other] https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- [other] https://wiki.zimbra.com/wiki/Security_Center
- [other] https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27926

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.