CVE-2019-9670

Synacor's Zimbra Collaboration Suite suffered an unpatched XXE vulnerability actively exploited in the wild, exposing organizations to data theft and ransomware.

The Zimbra Collaboration Suite (ZCS) mailboxd component contained an unpatched XML External Entity (XXE) vulnerability that was actively exploited in the wild. This failure stems from Synacor's chronic vulnerability management issues, where critical flaws persist long enough for ransomware campaigns to target them. DIB organizations must ensure their ZCS deployments are patched and monitored, as unpatched XXE flaws can lead to data exfiltration and serve as an entry point for ransomware.

Shame score — The vulnerability remained unpatched long enough to be actively exploited in the wild, reflecting a systemic failure in vulnerability management and exposing organizations to data breaches and ransomware.