PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-7796 Synacor CVE debrief

CVE-2020-7796 is a server-side request forgery issue affecting Synacor Zimbra Collaboration Suite (ZCS). CISA has added it to the Known Exploited Vulnerabilities catalog, which means defenders should treat it as a live risk and prioritize mitigation using vendor guidance. The supplied CISA record does not provide a CVSS score, so operational urgency here is driven by known exploitation status rather than a published severity rating.

Vendor
Synacor
Product
Zimbra Collaboration Suite
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2026-02-17
Original CVE updated
2026-02-17
Advisory published
2026-02-17
Advisory updated
2026-02-17

Who should care

Zimbra Collaboration Suite administrators, security teams responsible for internet-facing mail or collaboration services, and cloud or hosted service operators that rely on ZCS should prioritize this CVE. Teams subject to CISA BOD 22-01 guidance should also review their response timelines immediately.

Technical summary

The vulnerability is identified as a server-side request forgery (SSRF) in Synacor Zimbra Collaboration Suite. Based on the supplied corpus, the key security signal is that CISA lists the issue in its Known Exploited Vulnerabilities catalog. No additional technical details, impact scope, or attack preconditions are provided in the supplied sources.

Defensive priority

High

Recommended defensive actions

  • Apply mitigations per vendor instructions as soon as possible.
  • Follow applicable CISA BOD 22-01 guidance for cloud services if relevant to your environment.
  • If mitigations are unavailable or cannot be deployed in a timely way, discontinue use of the affected product or service.
  • Inventory Zimbra Collaboration Suite deployments and confirm whether any instances are exposed or operationally critical.
  • Track remediation against the CISA KEV due date supplied in the record (2026-03-10).

Evidence notes

This debrief is based only on the supplied CISA KEV source item and the official resource links provided in the prompt. The source item identifies the product as Synacor Zimbra Collaboration Suite, classifies the issue as an SSRF vulnerability, and marks it as a known exploited vulnerability with dateAdded 2026-02-17 and dueDate 2026-03-10. The prompt also provides official CVE and NVD record links, but no CVSS score or additional exploit details were included in the supplied corpus.

Official resources

CISA lists CVE-2020-7796 in the Known Exploited Vulnerabilities catalog. The supplied record does not include exploit details beyond the SSRF classification and KEV status, so this debrief avoids unsupported technical claims.