PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-3402 Synacor CVE debrief

CVE-2016-3402 is a high-severity Zimbra Collaboration issue that can let a remote attacker affect confidentiality in versions before 8.7.0. The NVD record indicates network access, no privileges, and no user interaction are required, but the public record does not describe the exact attack path. The vendor-linked release notes and security advisories point to 8.7.0 as the relevant fixed release.

Vendor
Synacor
Product
CVE-2016-3402
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Organizations running Zimbra Collaboration Suite versions at or below 8.6.0, especially internet-facing deployments and any environment handling sensitive email or collaboration data.

Technical summary

NVD classifies the issue as CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a remotely reachable confidentiality problem with no required privileges or user interaction. The public sources do not provide a more specific weakness description beyond 'NVD-CWE-noinfo,' so the exact vulnerable code path is not documented in the supplied corpus. The CPE range in NVD marks Zimbra Collaboration Suite versions through 8.6.0 as vulnerable, with Zimbra 8.7.0 referenced in vendor material as the release associated with remediation.

Defensive priority

High. This is a remotely reachable, unauthenticated confidentiality issue in a mail/collaboration platform, so exposed or sensitive Zimbra deployments should be prioritized for upgrade and verification.

Recommended defensive actions

  • Upgrade Zimbra Collaboration Suite to 8.7.0 or later using vendor guidance.
  • Confirm all deployed Zimbra instances and versions, including test, staging, and HA nodes.
  • Review the Zimbra Security Advisories and 8.7.0 release notes for the vendor's remediation context.
  • If immediate upgrade is not possible, reduce exposure of Zimbra services to trusted networks while planning remediation.
  • Monitor authentication and access logs for unusual access to mail or collaboration content.

Evidence notes

The debrief is based on the NVD CVE record and the linked Zimbra release notes and security advisories. NVD lists the vulnerable CPE as synacor:zimbra_collaboration_suite through 8.6.0 and assigns CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The supplied sources do not identify a specific CWE beyond NVD-CWE-noinfo, so no more detailed exploitation or root-cause claim is made here.

Official resources

Public debrief prepared from the supplied official CVE/NVD record and linked vendor pages. No exploit instructions or unsupported details included.