PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-3402 Synacor CVE debrief

CVE-2016-3402 is a high-severity Zimbra Collaboration issue that can let a remote attacker affect confidentiality in versions before 8.7.0. The NVD record indicates network access, no privileges, and no user interaction are required, but the public record does not describe the exact attack path. The vendor-linked release notes and security advisories point to 8.7.0 as the relevant fixed release.

Vendor
Synacor
Product
Zimbra Collaboration Suite
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Organizations running Zimbra Collaboration Suite versions at or below 8.6.0, especially internet-facing deployments and any environment handling sensitive email or collaboration data.

Technical summary

NVD classifies the issue as CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a remotely reachable confidentiality problem with no required privileges or user interaction. The public sources do not provide a more specific weakness description beyond 'NVD-CWE-noinfo,' so the exact vulnerable code path is not documented in the supplied corpus. The CPE range in NVD marks Zimbra Collaboration Suite versions through 8.6.0 as vulnerable, with Zimbra 8.7.0 referenced in vendor material as the release associated with remediation.

Defensive priority

High. This is a remotely reachable, unauthenticated confidentiality issue in a mail/collaboration platform, so exposed or sensitive Zimbra deployments should be prioritized for upgrade and verification.

Recommended defensive actions

  • Upgrade Zimbra Collaboration Suite to 8.7.0 or later using vendor guidance.
  • Confirm all deployed Zimbra instances and versions, including test, staging, and HA nodes.
  • Review the Zimbra Security Advisories and 8.7.0 release notes for the vendor's remediation context.
  • If immediate upgrade is not possible, reduce exposure of Zimbra services to trusted networks while planning remediation.
  • Monitor authentication and access logs for unusual access to mail or collaboration content.

Evidence notes

The debrief is based on the NVD CVE record and the linked Zimbra release notes and security advisories. NVD lists the vulnerable CPE as synacor:zimbra_collaboration_suite through 8.6.0 and assigns CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The supplied sources do not identify a specific CWE beyond NVD-CWE-noinfo, so no more detailed exploitation or root-cause claim is made here.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-3402 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-3402

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-3402 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-3402

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.