OR *cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:* versions from (including) 10.0.0 up to (excluding) 10.0.18 *cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:* versions from (including) 10.1.0 up to (excluding) 10.1.13
OR *cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* versions from (including) 10.0.0 up to (excluding) 10.0.18 *cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* versions from (including) 10.1.0 up to (excluding) 10.1.13
CVE CISA KEV Update by Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government 1/22/2026 9:00:02 PM
Action
Type
Old Value
New Value
Added
Date Added
2026-01-22
Added
Due Date
2026-02-12
Added
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Added
Vulnerability Name
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
OR *cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:* versions from (including) 10.0.0 up to (excluding) 10.0.18 *cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:* versions from (including) 10.1.0 up to (excluding) 10.1.13
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.