Cve20207796 Zimbra Collaboration Suite Full [top] Jun 2026

Accessing sensitive internal information or resources.

To understand CVE-2020-27996, one must first understand how Zimbra handles proxy requests and session management.

This patch explicitly fixes the validation flaw in the WebEx zimlet JSP component.

Attackers can capture session tokens to bypass multi-factor authentication. cve20207796 zimbra collaboration suite full

Threat actors have chained this SSRF vulnerability with other flaws to gain a foothold on server filesystems. Intelligence reports observe actors deploying downstream malware, such as the Dogkild worm or remote control utilities, onto vulnerable systems.

The flaw is classified under . It stems from insufficient validation of user-supplied URLs within a core application endpoint. Specifically, the vulnerability triggers when: The WebEx Zimlet is installed on the ZCS system. The Zimlet JSP (JavaServer Pages) functionality is enabled.

To secure your environment, the following actions are recommended by security researchers and official Zimbra documentation : Accessing sensitive internal information or resources

The flaw stems from insufficient input validation within a specific application component in the Zimbra platform. When a platform fails to sanitize user-supplied URLs, it allows an attacker to abuse the server as a proxy to make unintended outbound requests.

CVE-2020-7796 refers to a high-severity vulnerability discovered in the Zimbra Collaboration Suite (ZCS). This flaw specifically targets the Zimbra drive component, leading to a Cross-Site Scripting (XSS) vulnerability that can compromise user accounts and sensitive organizational data.

: Force the server to query internal applications (such as databases or internal admin dashboards) that are shielded from the public internet. Attackers can capture session tokens to bypass multi-factor

Quick Info * NVD Published Date: 02/18/2020. * NVD Last Modified: 02/18/2026. * Source: MITRE. National Institute of Standards and Technology (.gov) Zimbra Collaboration Suite SSRF (CVE-2020-7796) - Acunetix

The phrase often appears in exploit databases and security write-ups to indicate full chain exploitation — meaning the XSS alone is not the final goal; it is used as a stepping stone for:

Despite being originally identified in 2020, CVE-2020-7796 has seen a massive resurgence in activity. Security researchers observed a significant spike in exploitation attempts in early 2026, with nearly targeting the flaw globally. This surge prompted CISA to mandate federal agencies to apply fixes by March 10, 2026 . Remediation and Mitigation CVE-2020-7796 Detail - NVD