Synacor vulnerabilities attackers have used

Every Synacor entry in CISA KEV

1. CVE-2026-73570

   Added Aug 21, 2026 · due Aug 24, 2026

   Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

   Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as…

2. CVE-2025-48700

   Added Apr 20, 2026 · due Apr 23, 2026

   Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

   Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive…

3. CVE-2025-66376

   Added Mar 18, 2026 · due Apr 1, 2026

   Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

   Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.

4. CVE-2020-7796

   Added Feb 17, 2026 · due Mar 10, 2026

   Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

   Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.

5. CVE-2025-68645

   Added Jan 22, 2026 · due Feb 12, 2026

   Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

   Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of…

6. CVE-2025-27915

   Added Oct 7, 2025 · due Oct 28, 2025

   Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

   Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a…

7. CVE-2019-9621

   Added Jul 7, 2025 · due Jul 28, 2025

   Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

   Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.

8. CVE-2024-27443

   Added May 19, 2025 · due Jun 9, 2025

   Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

   Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted…

9. CVE-2023-34192

   Added Feb 25, 2025 · due Mar 18, 2025

   Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

   Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

10. CVE-2024-45519

    Added Oct 3, 2024 · due Oct 24, 2024

    Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.

11. CVE-2023-37580

    Added Jul 27, 2023 · due Aug 17, 2023

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.

12. CVE-2022-27926

    Added Apr 3, 2023 · due Apr 24, 2023

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.

13. CVE-2022-41352

    RansomwareAdded Oct 20, 2022 · due Nov 10, 2022

    Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.

14. CVE-2022-37042

    RansomwareAdded Aug 11, 2022 · due Sep 1, 2022

    Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.

15. CVE-2022-27925

    RansomwareAdded Aug 11, 2022 · due Sep 1, 2022

    Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which…

16. CVE-2022-27924

    RansomwareAdded Aug 4, 2022 · due Aug 25, 2022

    Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.

17. CVE-2018-6882

    RansomwareAdded Apr 19, 2022 · due May 10, 2022

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.

18. CVE-2022-24682

    RansomwareAdded Feb 25, 2022 · due Mar 11, 2022

    Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.

19. CVE-2019-9670

    Added Jan 10, 2022 · due Jul 10, 2022

    Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

    Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.

Related

• All vendors in CISA KEV

  Ranked by how many exploited vulnerabilities each has.

• Latest CVEs this week

  Critical and High CVEs from the last 7 days, with KEV and EPSS.

• Vulnerability watch

  A briefing and a fix pull request when an advisory hits your dependencies.