NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Zimbra WebEx request-forgery flaw CVE-2020-7796 used in attacks; fixed since 2020

Attackers are exploiting an old Zimbra mail-server flaw that can reach internal systems when the WebEx add-on and JSP feature are enabled. A fix shipped in 8.8.15 Patch 7 in 2020. Ask your email provider or IT team to verify remediation and a supported release.

What to do

If your family, business or family office uses Zimbra email, ask the provider or IT team to confirm that CVE-2020-7796 is fixed and the server runs a supported release; the first fix was 8.8.15 Patch 7. The update belongs on the mail server, so updating your phone or email app does not fix it.

What’s happening

CVE-2020-7796 lets attackers make a vulnerable Zimbra Collaboration mail server send unauthorised requests to internal systems, potentially exposing information or enabling further attacks. It requires the WebEx zimlet add-on to be installed and its JSP feature enabled, so not every Zimbra installation is exposed. Zimbra released the fix in 8.8.15 Patch 7 on 12 February 2020. GreyNoise reported exploitation attempts in March 2025, and CISA formally listed the flaw as actively exploited on 17 February 2026. Check Point published detection guidance two days later. The reviewed sources do not identify particular victims, quantify successful compromises or establish that attacks have stopped. As at 3 November 2026, a released fix exists, but the old 8.8.15 branch has passed its final listed support milestone. Organisations still using it should move to a supported release.

What
Flaw
Affects
Zimbra Collaboration Suite email server with the WebEx zimlet add-on
Affected
Zimbra Collaboration Suite before 8.8.15 Patch 7, when the WebEx zimlet is installed and zimlet JSP is enabled
Fixed in
Zimbra Collaboration Suite 8.8.15 Patch 7
CVE
CVE-2020-7796
Since
17 Feb 2026
Closed
19 Feb 2026

Timeline

  1. Update

    Check Point published a Security Gateway protection advisory for detecting attempts to exploit this flaw. This additional protection did not replace Zimbra’s existing software fix.

  2. CISA added

    CISA added CVE-2020-7796 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.

  3. Wider attacks

    GreyNoise reported exploitation attempts against CVE-2020-7796 during a surge observed on 9 March. About 400 source IP addresses targeted multiple request-forgery flaws; that total was not specific to Zimbra.

  4. Update

    Zimbra 8.8.15 reached the end of technical guidance, its final listed support milestone.

  5. New fixFixed

    Zimbra released 8.8.15 Patch 7, fixing CVE-2020-7796. The flaw requires the WebEx zimlet add-on to be installed and zimlet JSP to be enabled.

Sources

  1. Zimbra Releases/8.8.15/P7Zimbra · 12 Feb 2020
  2. Zimbra 8.8.15 “James Prescott Joule” Patch 7Zimbra · 12 Feb 2020
  3. CISA Adds Four Known Exploited Vulnerabilities to CatalogCISA · 17 Feb 2026
  4. New SSRF Exploitation Surge Serves as a Reminder of 2019 Capital One BreachGreyNoise · 11 Mar 2025
  5. Zimbra Collaboration Suite Server-Side Request Forgery (CVE-2020-7796)Check Point · 19 Feb 2026
  6. CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV UpdateThe Hacker News · 18 Feb 2026
  7. Zimbra Product ReleasesZimbra
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS