CVE-2018-6882

Synacor's Zimbra Collaboration Suite has a critical XSS vulnerability actively exploited by ransomware groups, demonstrating a failure to patch critical flaws promptly.

A cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite allows attackers to inject arbitrary web scripts, potentially leading to data theft or system compromise. DIB organizations using Zimbra face increased risk of ransomware infection and compliance violations (NIST 800-171 controls 3.1.1, 3.1.2, 3.1.3) and should immediately patch and review security configurations.

Shame score — The persistent, unpatched nature of the vulnerability and its exploitation by ransomware highlights a significant and avoidable security management failure.