CVE-2019-9621 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF)

Exploited in the wild High 7.5 Published 30 Apr 2019 Updated 21 Oct 2025

Attackers can exploit a Server-Side Request Forgery vulnerability in the ProxyServlet component to access internal resources or bypass security controls.

Exploited in the wild: Since 7 Jul 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-9621?

CVE-2019-9621 is a high-severity server-side request forgery vulnerability in Synacor Zimbra Collaboration Suite, published on 30 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

Weakness: CWE-918

Which versions are affected by CVE-2019-9621?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2019-9621?

No fix has been published for CVE-2019-9621 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Jul 2025.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2019-9621 being exploited?

Yes. Attackers have exploited CVE-2019-9621 in the wild since at least 7 Jul 2025.

Public exploit code: 1 Metasploit module, 6 Exploit-DB entries, 1 Nuclei template and 1 proofs of concept on GitHub.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-gf2h-5qx6-v9fr.