{"id":"zimbra-webex-ssrf-exploited-feb-2026","category":"patch","status":"closed","title":"Zimbra WebEx request-forgery flaw CVE-2020-7796 used in attacks; fixed since 2020","tldr":"Attackers are exploiting an old Zimbra mail-server flaw that can reach internal systems when the WebEx add-on and JSP feature are enabled. A fix shipped in 8.8.15 Patch 7 in 2020. Ask your email provider or IT team to verify remediation and a supported release.","summary":"CVE-2020-7796 lets attackers make a vulnerable Zimbra Collaboration mail server send unauthorised requests to internal systems, potentially exposing information or enabling further attacks. It requires the WebEx zimlet add-on to be installed and its JSP feature enabled, so not every Zimbra installation is exposed. Zimbra released the fix in 8.8.15 Patch 7 on 12 February 2020. GreyNoise reported exploitation attempts in March 2025, and CISA formally listed the flaw as actively exploited on 17 February 2026. Check Point published detection guidance two days later. The reviewed sources do not identify particular victims, quantify successful compromises or establish that attacks have stopped. As at 3 November 2026, a released fix exists, but the old 8.8.15 branch has passed its final listed support milestone. Organisations still using it should move to a supported release.","action":"If your family, business or family office uses Zimbra email, ask the provider or IT team to confirm that CVE-2020-7796 is fixed and the server runs a supported release; the first fix was 8.8.15 Patch 7. The update belongs on the mail server, so updating your phone or email app does not fix it.","product":"Zimbra Collaboration Suite email server with the WebEx zimlet add-on","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2020-7796"],"tags":["zimbra","synacor","email","ssrf","actively-exploited"],"affected":["Zimbra Collaboration Suite before 8.8.15 Patch 7, when the WebEx zimlet is installed and zimlet JSP is enabled"],"fixed":["Zimbra Collaboration Suite 8.8.15 Patch 7"],"matches":[],"sources":[{"kind":"advisory","title":"Zimbra Releases/8.8.15/P7","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7","by":"Zimbra","date":"2020-02-12"},{"kind":"post","title":"Zimbra 8.8.15 “James Prescott Joule” Patch 7","url":"https://blog.zimbra.com/2020/02/new-zimbra-8-8-15-james-prescott-joule-patch-7/","by":"Zimbra","date":"2020-02-12"},{"kind":"advisory","title":"CISA Adds Four Known Exploited Vulnerabilities to Catalog","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40a4268","by":"CISA","date":"2026-02-17"},{"kind":"research","title":"New SSRF Exploitation Surge Serves as a Reminder of 2019 Capital One Breach","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","by":"GreyNoise","date":"2025-03-11"},{"kind":"advisory","title":"Zimbra Collaboration Suite Server-Side Request Forgery (CVE-2020-7796)","url":"https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2020-4652.html","by":"Check Point","date":"2026-02-19"},{"kind":"news","title":"CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV Update","url":"https://thehackernews.com/2026/02/cisa-flags-four-security-flaws-under.html","by":"The Hacker News","date":"2026-02-18"},{"kind":"advisory","title":"Zimbra Product Releases","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases","by":"Zimbra","date":""}],"started":"2026-02-17","closed":"2026-02-19","created":"2026-11-03T22:31:12.544Z","updated":"2026-11-03T22:31:12.544Z","cve_notes":[{"cve":"CVE-2020-7796","name":"Server-side request forgery in Zimbra’s WebEx add-on","what":"When the WebEx zimlet and zimlet JSP feature are enabled, a flaw in Zimbra Collaboration Suite before 8.8.15 Patch 7 lets attackers make the mail server send unauthorised requests to internal systems.","severity":"unknown","cvss":9.8}],"timeline":[{"at":"2026-02-19","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Check Point published a Security Gateway protection advisory for detecting attempts to exploit this flaw. This additional protection did not replace Zimbra’s existing software fix.","url":"https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2020-4652.html","by":"Check Point","patch":null},{"at":"2026-02-17","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2020-7796 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40a4268","by":"CISA","patch":null},{"at":"2025-03-11","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"GreyNoise reported exploitation attempts against CVE-2020-7796 during a surge observed on 9 March. About 400 source IP addresses targeted multiple request-forgery flaws; that total was not specific to Zimbra.","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","by":"GreyNoise","patch":null},{"at":"2024-12-31","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Zimbra 8.8.15 reached the end of technical guidance, its final listed support milestone.","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases","by":"Zimbra","patch":null},{"at":"2020-02-12","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"Zimbra released 8.8.15 Patch 7, fixing CVE-2020-7796. The flaw requires the WebEx zimlet add-on to be installed and zimlet JSP to be enabled.","url":"https://blog.zimbra.com/2020/02/new-zimbra-8-8-15-james-prescott-joule-patch-7/","by":"Zimbra","patch":"patched"}],"url":"https://hard.fyi/live/zimbra-webex-ssrf-exploited-feb-2026/","json":"https://hard.fyi/api/live?id=zimbra-webex-ssrf-exploited-feb-2026"}