PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-7796 Synacor CVE debrief

CVE-2020-7796 is a server-side request forgery issue affecting Synacor Zimbra Collaboration Suite (ZCS). CISA has added it to the Known Exploited Vulnerabilities catalog, which means defenders should treat it as a live risk and prioritize mitigation using vendor guidance. The supplied CISA record does not provide a CVSS score, so operational urgency here is driven by known exploitation status rather than a published severity rating.

Vendor
Synacor
Product
Zimbra Collaboration Suite
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2026-02-17
Original CVE updated
2026-02-17
Advisory published
2026-02-17
Advisory updated
2026-02-17

Who should care

Zimbra Collaboration Suite administrators, security teams responsible for internet-facing mail or collaboration services, and cloud or hosted service operators that rely on ZCS should prioritize this CVE. Teams subject to CISA BOD 22-01 guidance should also review their response timelines immediately.

Technical summary

The vulnerability is identified as a server-side request forgery (SSRF) in Synacor Zimbra Collaboration Suite. Based on the supplied corpus, the key security signal is that CISA lists the issue in its Known Exploited Vulnerabilities catalog. No additional technical details, impact scope, or attack preconditions are provided in the supplied sources.

Defensive priority

High

Recommended defensive actions

  • Apply mitigations per vendor instructions as soon as possible.
  • Follow applicable CISA BOD 22-01 guidance for cloud services if relevant to your environment.
  • If mitigations are unavailable or cannot be deployed in a timely way, discontinue use of the affected product or service.
  • Inventory Zimbra Collaboration Suite deployments and confirm whether any instances are exposed or operationally critical.
  • Track remediation against the CISA KEV due date supplied in the record (2026-03-10).

Evidence notes

This debrief is based only on the supplied CISA KEV source item and the official resource links provided in the prompt. The source item identifies the product as Synacor Zimbra Collaboration Suite, classifies the issue as an SSRF vulnerability, and marks it as a known exploited vulnerability with dateAdded 2026-02-17 and dueDate 2026-03-10. The prompt also provides official CVE and NVD record links, but no CVSS score or additional exploit details were included in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2020-7796 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2020-7796

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2020-7796 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2020-7796

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.