CVE-2018-6882VulnerabilityPublished 04/19/2022Updated 10/24/2026

CVE-2018-6882: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Affects Synacor Zimbra Collaboration Suite (ZCS)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 04/19/2022
KEV deadline: 05/10/2022
Ransomware: Used in ransomware campaigns
EPSS: 29.8% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2018-6882 (opens in a new tab)

Description

Synacor Zimbra Collaboration Suite (ZCS) has a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web scripts or HTML. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided.

Summary

CVE-2018-6882 identifies a cross-site scripting vulnerability in Synacor's Zimbra Collaboration Suite (ZCS). This vulnerability enables remote attackers to inject arbitrary web script or HTML, potentially leading to client-side code execution within the context of the affected web application. The vulnerability has been exploited in the wild and linked to ransomware campaigns. No detailed version or patch information is available from the provided data.

Impact

Exploitation of this XSS vulnerability can allow attackers to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, credential theft, or delivery of malicious payloads such as ransomware. The presence of known exploitation in the wild and ransomware campaign use indicates active threat and significant risk to affected environments.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying web application firewalls or input validation controls to mitigate exploitation risks.

Weaknesses

CWE-79Cross-Site Scripting (XSS) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:27:12 UTC

Weaknesses

References

Related threats