Is CVE-2022-27926 (Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2022-27926 to its Known Exploited Vulnerabilities catalogue on 3 April 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.

What “exploited in the wild” means for this CVE

For a CVE question like this, the practical issue is not whether the flaw exists, but whether defenders should treat it as an active exposure. CISA’s Known Exploited Vulnerabilities catalogue is the strongest operational signal here because it is reserved for vulnerabilities with reliable evidence of exploitation, which makes the answer materially different from a hypothetical XSS finding.

For Zimbra deployments, that means the question is really about exposure triage: whether the vulnerable endpoint is reachable, whether the affected web surface is still exposed to users, and whether the environment should be prioritised for remediation alongside other active web application flaws. For a broader reference on XSS patterns and containment, see the Cross-Site Scripting (XSS) Prevention Guide.

What defenders should verify before they assume they are safe

Start by confirming whether any Zimbra Collaboration Suite instance is internet-facing or reachable from untrusted internal segments, then validate whether the endpoint path associated with the issue is present in your deployment. Because the direct answer ties this CVE to unsanitised parameter handling, the main practical question is whether user input is still reaching the affected code path without server-side encoding or sanitisation.

That verification should include reverse proxies, WAF rules, and custom URL rewriting, because a control that blocks one route may leave another route exposed. If you are using a general vulnerability workflow, the Vulnerability Management Guide is the right place to anchor KEV-driven triage, exception handling, and remediation tracking for an exploited CVE.

How to respond when patching has to wait

If remediation cannot happen immediately, treat this as a web-layer exposure that needs temporary containment rather than passive monitoring. Reduce reachability, tighten access to the relevant application paths, and review any compensating controls that can prevent script injection from being delivered back to the browser, including request filtering and response hardening where they are actually effective.

Where the vulnerable service handles user sessions, remember that an XSS issue can be used to act in the context of a logged-in user, so the short-term goal is to shrink the number of sessions that can reach the vulnerable path and limit what those sessions can do. For an operational view of when a vulnerability is already being exploited and how to prioritise emergency action, the Zero-Day and Exploited Vulnerabilities Guide gives the right response model.

Risk and Threat Considerations

Exploited XSS in a collaboration suite is not just a nuisance defect. It can become an account-impacting issue when the injected script runs in an authenticated session, especially in a system that users trust for mail, calendaring, and internal communication.

Failure mechanism: The attacker relies on unsanitised input reaching a browser context, then uses that execution to steal session data, trigger actions as the victim, or pivot into further phishing and internal compromise.

Impact: The practical impact can include session hijack, message tampering, credential or token theft, and follow-on abuse of trusted collaboration workflows.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes vulnerability prioritisation central to the response.
Recommendation — Prioritise and track remediation for KEV-listed vulnerabilities before routine backlog work.
OWASP ASVS	V13 — Configuration	XSS exposure here depends on how the application handles input and browser-facing output paths.
	V14 — Data Protection	Exploited XSS can expose session data and other browser-held sensitive material.
	V1 — Encoding and Sanitization	The flaw is an input sanitisation failure that permits script injection.
Recommendation — Harden request handling and output controls around the affected endpoint. Protect sensitive data in browser workflows and reduce exposure if script execution occurs. Apply context-appropriate output encoding and input sanitisation on the vulnerable path.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV status makes monitoring and prioritisation for this flaw operationally necessary.
Recommendation — Continuously scan for and prioritise remediation of actively exploited vulnerabilities.

Practitioner Guidance

What to prioritise: Treat KEV-listed exploitation as a response queueing issue, not a code-review debate. Prioritise external exposure, active user populations, and any Zimbra instance that supports high-trust mail flows or privileged users.

What to verify: Confirm whether the vulnerable endpoint is reachable, whether the fix or mitigation is actually in place, and whether existing sessions or browser state could still be abused after remediation. If you have to defer patching, document the compensating control and its expected failure mode.

Practitioner takeaway: For an exploited XSS CVE, the key decision is whether the service can still deliver attacker-controlled script into a trusted user session, because that determines whether you need urgent containment as well as remediation.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org