CVE-2019-9670VulnerabilityPublished 01/10/2022Updated 10/24/2026

CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

Affects Synacor Zimbra Collaboration Suite (ZCS)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/10/2022
KEV deadline: 07/10/2022
EPSS: 100.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-9670 (opens in a new tab)

Description

CVE-2019-9670 is an XML External Entity (XXE) vulnerability in the mailboxd component of Synacor Zimbra Collaboration Suite (ZCS). This vulnerability allows improper restriction of XML external entity references, which can be exploited to access unauthorized data or cause denial of service. It has been exploited in the wild and is considered high severity.

Summary

Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in its mailboxd component. This vulnerability, tracked as CVE-2019-9670, allows attackers to exploit XML parsing to access external entities, potentially leading to unauthorized data disclosure or denial of service conditions. The vulnerability has been observed in active exploitation campaigns.

Impact

Exploitation of this XXE vulnerability can lead to unauthorized disclosure of sensitive information or denial of service against the mailboxd service. The vulnerability has been confirmed to be exploited in the wild, indicating active threat to affected systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Synacor's advisories for updates and consider applying any recommended mitigations once available.

Weaknesses

CWE-611XML External Entity (XXE) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:56:38 UTC

Weaknesses

References

Related threats