CVE-2022-27926: Zimbra Collaboration Suite reflected XSS in launchNewWindow.jsp

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is unauthenticated to trigger and listed in CISA KEV as exploited in the wild, though it requires victim interaction and has only medium CVSS impact.

What it is

Zimbra Collaboration Suite 9.0 contains a reflected cross-site scripting flaw in the /public/launchNewWindow.jsp component, where request parameters are echoed into the response without adequate sanitization. Because the endpoint is public and requires no authentication, it is reachable by anyone who can get a victim to open a crafted link. The record does not specify which request parameters are vulnerable.

Impact

An attacker can run arbitrary script or HTML in the context of the Zimbra web origin, which can steal session cookies or tokens and act as the victim user. The CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via the public /public/launchNewWindow.jsp endpoint; no authentication is required (PR:N), but the victim must interact with a crafted link or page (UI:R).

Exploitation

CVE-2022-27926 is listed in CISA KEV with a due date of 2023-04-24, indicating known exploitation in the wild; EPSS is 0.17634 (96.99th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor update for Zimbra Collaboration Suite 9.0 (P24 or later per the vendor release notes) as the first action.
• If immediate patching is not possible, restrict or block external access to /public/launchNewWindow.jsp until the update is applied.
• Deploy a WAF rule that blocks script payloads in request parameters to that endpoint as a temporary compensating control.
• Review Zimbra security advisories and confirm no other public endpoints reflect unsanitized parameters.

Detection

• Search web access logs for requests to /public/launchNewWindow.jsp containing script tags, event handlers, or encoded equivalents in query parameters.
• Alert on unusual referrer or inbound links pointing to that endpoint from external or untrusted sites.
• Monitor for anomalous authenticated session activity or token use originating from users who recently hit that endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.