Synacor
Vulnerability activity for Synacor: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 365 days
- CVEs
- 8
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 5
- With exploit code
- 3
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 8.9HighAug 21, 2026Synacor Zimbra Collaboration Suite (ZCS) Code / command injectionCVE-2026-73570Affected: Zimbra Collaboration Suite (ZCS) before version 9.1.0.P9. Attacker gains: Arbitrary code execution on the ZCS server. Recommended action: Upgrade to Zimbra Collaboration Suite version 9.1.0.P9 or later.Added to KEV Aug 21, 2026Exploited72% likelyExploit codeNucleiDetection
- 6.1MediumApr 20, 2026Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2025-487001. Synacor Zimbra Collaboration Suite (ZCS) web interface is affected. 2. An attacker gains ability to inject malicious scripts, potentially leading to session hijacking or data theft. 3. Apply Zimbra Collaboration Suite patches and update to the latest version available.Added to KEV Apr 20, 2026Exploited1.7% likely
- 7.2HighMar 18, 2026Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2025-66376Affected: Synacor Zimbra Collaboration Suite (ZCS) web interface. Attacker gains: Ability to execute arbitrary JavaScript code, potentially leading to session hijacking or data theft. Recommended action: Apply the latest security patches from Synacor to the affected ZCS version.Added to KEV Mar 18, 2026Exploited20% likely
- 9.8CriticalFeb 17, 2026Synacor Zimbra Collaboration Suite SSRFCVE-2020-7796Zimbra Collaboration Suite server. Attacker gains ability to execute arbitrary system operations. Update to Zimbra Collaboration Suite version 8.8.15 or later.Added to KEV Feb 17, 2026Exploited84% likelyExploit codeNucleiDetection
- 8.8HighJan 22, 2026Synacor Zimbra Collaboration Suite (ZCS) Path traversal / file handlingCVE-2025-68645Affected: Synacor Zimbra Collaboration Suite (ZCS) PHP application. Attacker gains: Unauthenticated remote code execution (RCE) and arbitrary file inclusion. Recommended action: Apply the latest security patches and update ZCS to a secure version.Added to KEV Jan 22, 2026Exploited49% likelyExploit codeNucleiDetection
- 5.4MediumMar 12, 2025Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2025-279151. Users of Synacor Zimbra Collaboration Suite (ZCS) are affected. 2. An attacker gains the ability to inject malicious JavaScript code, potentially leading to session hijacking or data theft. 3. Apply the latest patches and update to ZCS version 9.2.0 or later to mitigate this vulnerability.Added to KEV Oct 7, 2025 · 209 days after publicationExploited4.1% likelyExploit codeNucleiDetection
- 7.5HighApr 30, 2019Synacor Zimbra Collaboration Suite (ZCS) SSRFCVE-2019-9621Affected: Synacor Zimbra Collaboration Suite (ZCS) prior to 8.8.15 Patch 30. Attacker gains: Ability to make unauthorized requests to internal services, potentially leading to information disclosure or lateral movement. Recommended action: Update to ZCS 8.8.15 Patch 30 or later.Added to KEV Jul 7, 2025 · 2,259 days after publicationExploited81% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 6.1MediumAug 12, 2024Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2024-27443Email clients and web interfaces of Zimbra Collaboration Suite are affected. An attacker gains the ability to inject malicious scripts into a user's session, potentially stealing sensitive information or taking control of the user's account. Update to the latest version of Zimbra Collaboration Suite and apply all available patches to mitigate this vulnerability.Added to KEV May 19, 2025 · 280 days after publicationExploited25% likelyExploit codeNucleiDetection
- 9.0CriticalJul 6, 2023Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2023-34192Email client, Attacker gains access to sensitive user information and ability to inject malicious scripts, Update to the latest version of Zimbra Collaboration Suite (ZCS) to patch the vulnerability.Added to KEV Feb 25, 2025 · 600 days after publicationExploited77% likelyExploit codeNucleiDetection
- 10.0CriticalOct 2, 2024Synacor Zimbra Collaboration Suite (ZCS) Auth bypass / access controlCVE-2024-45519Zimbra Collaboration Suite (ZCS) versions 9.0.0 before 9.0.0.P31 and 8.8.15 before 8.8.15.P15 are affected. An attacker gains the ability to execute arbitrary system commands, potentially leading to remote code execution. Update to ZCS version 9.0.0.P31 or later to remediate this vulnerability.Added to KEV Oct 3, 2024 · 1 day after publicationExploited100% likelyExploit codeNucleiDetection
- 6.1MediumJul 31, 2023Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2023-37580Email client, Unrestricted access to sensitive user data, Patch the vulnerable ZCS version to the latest available update.Added to KEV Jul 27, 2023 · same day as publicationExploited49% likelyExploit codeNucleiDetection
- 6.1MediumApr 20, 2022Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2022-27926Email client, Sensitive user data and session tokens, Apply the patches provided by Synacor to version 9.0.0 Patch 38 or later.Added to KEV Apr 3, 2023 · 347 days after publicationExploited18% likelyExploit codeNucleiDetection
- 9.8CriticalSep 26, 2022Synacor Zimbra Collaboration Suite (ZCS) Path traversal / file handlingCVE-2022-41352(1) Synacor Zimbra Collaboration Suite (ZCS) web interface is affected. (2) An attacker gains arbitrary file upload and remote code execution capabilities. (3) Update to the latest version of ZCS and apply security patches.Added to KEV Oct 20, 2022 · 24 days after publicationExploited95% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalAug 11, 2022Synacor Zimbra Collaboration Suite (ZCS) Path traversal / file handlingCVE-2022-37042Email accounts, Unauthenticated remote access to sensitive data and system administration, Update to version 9.0.0.P20 or later, and apply relevant patches.Added to KEV Aug 11, 2022 · same day as publicationExploited92% likelyExploit codeMetasploit · NucleiDetection
- 7.2HighApr 20, 2022Synacor Zimbra Collaboration Suite (ZCS) Path traversal / file handlingCVE-2022-279251. The Synacor Zimbra Collaboration Suite (ZCS) is affected. 2. An attacker gains the ability to upload arbitrary files, potentially leading to remote code execution or other malicious activities. 3. Apply the patch released by Synacor to address this vulnerability, and ensure all users are updated to the latest version of ZCS.Added to KEV Aug 11, 2022 · 112 days after publicationExploited99% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalApr 20, 2022Synacor Zimbra Collaboration Suite (ZCS) Code / command injectionCVE-2022-27924Affected: Synacor Zimbra Collaboration Suite (ZCS) versions prior to 9.0.0 Patch 35. Attacker gains: Unauthenticated remote command execution. Recommended action: Upgrade to ZCS version 9.0.0 Patch 35 or later.Added to KEV Aug 4, 2022 · 105 days after publicationExploited94% likelyExploit codeNucleiDetection
- 6.1MediumMar 27, 2018Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2018-6882Affected: Synacor Zimbra Collaboration Suite (ZCS) versions 8.7.11, 8.8.7, 8.8.8, 8.8.9. Attacker gain: Ability to inject malicious JavaScript code to steal user data or perform unauthorized actions. Recommended action: Update ZCS to version 8.8.9 or later, or apply the provided patch.Added to KEV Apr 19, 2022 · 1,483 days after publicationExploited30% likelyExploit codeNucleiDetection
- 6.1MediumFeb 9, 2022Synacor Zimbra Collaborate Suite (ZCS) XSSCVE-2022-24682(1) The Synacor Zimbra Collaborate Suite (ZCS) is affected. (2) An attacker gains the ability to inject malicious scripts, potentially stealing user data or taking control of user sessions. (3) Apply the latest security patches for ZCS to mitigate this vulnerability.Added to KEV Feb 25, 2022 · 16 days after publicationExploited31% likelyExploit codeNucleiDetection
- 9.8CriticalMay 29, 2019Synacor Zimbra Collaboration Suite (ZCS)CVE-2019-96701. Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 12 and 8.7.11 Patch 25 is affected. 2. An attacker gains remote code execution and access to sensitive data. 3. Update to version 8.8.15 Patch 12 or 8.7.11 Patch 25.Added to KEV Jan 10, 2022 · 956 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
Recent
- 5.3MediumOct 29, 2026Synacor Zimbra Collaboration XSSCVE-2026-66912Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the unsanitized From header content is rendered as HTML and the JavaScript
- 5.3MediumOct 29, 2026Synacor Zimbra Collaboration XSSCVE-2026-66911Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when the victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser context. This issue was fixed in version 10.1.21
- 7.1HighOct 23, 2026Synacor zimbra collaboration suite CSRFCVE-2026-93631A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to loa
- 8.9HighAug 21, 2026Synacor Zimbra Collaboration Suite (ZCS) Code / command injectionCVE-2026-73570Affected: Zimbra Collaboration Suite (ZCS) before version 9.1.0.P9. Attacker gains: Arbitrary code execution on the ZCS server. Recommended action: Upgrade to Zimbra Collaboration Suite version 9.1.0.P9 or later.Exploited72% likelyExploit codeNucleiDetection
- 6.1MediumApr 20, 2026Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2025-487001. Synacor Zimbra Collaboration Suite (ZCS) web interface is affected. 2. An attacker gains ability to inject malicious scripts, potentially leading to session hijacking or data theft. 3. Apply Zimbra Collaboration Suite patches and update to the latest version available.Exploited1.7% likely
- 7.2HighMar 18, 2026Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2025-66376Affected: Synacor Zimbra Collaboration Suite (ZCS) web interface. Attacker gains: Ability to execute arbitrary JavaScript code, potentially leading to session hijacking or data theft. Recommended action: Apply the latest security patches from Synacor to the affected ZCS version.Exploited20% likely
- 9.8CriticalFeb 17, 2026Synacor Zimbra Collaboration Suite SSRFCVE-2020-7796Zimbra Collaboration Suite server. Attacker gains ability to execute arbitrary system operations. Update to Zimbra Collaboration Suite version 8.8.15 or later.Exploited84% likelyExploit codeNucleiDetection
- 8.8HighJan 22, 2026Synacor Zimbra Collaboration Suite (ZCS) Path traversal / file handlingCVE-2025-68645Affected: Synacor Zimbra Collaboration Suite (ZCS) PHP application. Attacker gains: Unauthenticated remote code execution (RCE) and arbitrary file inclusion. Recommended action: Apply the latest security patches and update ZCS to a secure version.Exploited49% likelyExploit codeNucleiDetection
- 5.4MediumMar 12, 2025Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2025-279151. Users of Synacor Zimbra Collaboration Suite (ZCS) are affected. 2. An attacker gains the ability to inject malicious JavaScript code, potentially leading to session hijacking or data theft. 3. Apply the latest patches and update to ZCS version 9.2.0 or later to mitigate this vulnerability.Exploited4.1% likelyExploit codeNucleiDetection
- 7.5HighApr 30, 2019Synacor Zimbra Collaboration Suite (ZCS) SSRFCVE-2019-9621Affected: Synacor Zimbra Collaboration Suite (ZCS) prior to 8.8.15 Patch 30. Attacker gains: Ability to make unauthorized requests to internal services, potentially leading to information disclosure or lateral movement. Recommended action: Update to ZCS 8.8.15 Patch 30 or later.Exploited81% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 6.1MediumAug 12, 2024Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2024-27443Email clients and web interfaces of Zimbra Collaboration Suite are affected. An attacker gains the ability to inject malicious scripts into a user's session, potentially stealing sensitive information or taking control of the user's account. Update to the latest version of Zimbra Collaboration Suite and apply all available patches to mitigate this vulnerability.Exploited25% likelyExploit codeNucleiDetection
- 9.0CriticalJul 6, 2023Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2023-34192Email client, Attacker gains access to sensitive user information and ability to inject malicious scripts, Update to the latest version of Zimbra Collaboration Suite (ZCS) to patch the vulnerability.Exploited77% likelyExploit codeNucleiDetection
- 10.0CriticalOct 2, 2024Synacor Zimbra Collaboration Suite (ZCS) Auth bypass / access controlCVE-2024-45519Zimbra Collaboration Suite (ZCS) versions 9.0.0 before 9.0.0.P31 and 8.8.15 before 8.8.15.P15 are affected. An attacker gains the ability to execute arbitrary system commands, potentially leading to remote code execution. Update to ZCS version 9.0.0.P31 or later to remediate this vulnerability.Exploited100% likelyExploit codeNucleiDetection
- 6.1MediumJul 31, 2023Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2023-37580Email client, Unrestricted access to sensitive user data, Patch the vulnerable ZCS version to the latest available update.Exploited49% likelyExploit codeNucleiDetection
- 6.1MediumApr 20, 2022Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2022-27926Email client, Sensitive user data and session tokens, Apply the patches provided by Synacor to version 9.0.0 Patch 38 or later.Exploited18% likelyExploit codeNucleiDetection
- 9.8CriticalSep 26, 2022Synacor Zimbra Collaboration Suite (ZCS) Path traversal / file handlingCVE-2022-41352(1) Synacor Zimbra Collaboration Suite (ZCS) web interface is affected. (2) An attacker gains arbitrary file upload and remote code execution capabilities. (3) Update to the latest version of ZCS and apply security patches.Exploited95% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalAug 11, 2022Synacor Zimbra Collaboration Suite (ZCS) Path traversal / file handlingCVE-2022-37042Email accounts, Unauthenticated remote access to sensitive data and system administration, Update to version 9.0.0.P20 or later, and apply relevant patches.Exploited92% likelyExploit codeMetasploit · NucleiDetection
- 7.2HighApr 20, 2022Synacor Zimbra Collaboration Suite (ZCS) Path traversal / file handlingCVE-2022-279251. The Synacor Zimbra Collaboration Suite (ZCS) is affected. 2. An attacker gains the ability to upload arbitrary files, potentially leading to remote code execution or other malicious activities. 3. Apply the patch released by Synacor to address this vulnerability, and ensure all users are updated to the latest version of ZCS.Exploited99% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalApr 20, 2022Synacor Zimbra Collaboration Suite (ZCS) Code / command injectionCVE-2022-27924Affected: Synacor Zimbra Collaboration Suite (ZCS) versions prior to 9.0.0 Patch 35. Attacker gains: Unauthenticated remote command execution. Recommended action: Upgrade to ZCS version 9.0.0 Patch 35 or later.Exploited94% likelyExploit codeNucleiDetection
- 6.1MediumMar 27, 2018Synacor Zimbra Collaboration Suite (ZCS) XSSCVE-2018-6882Affected: Synacor Zimbra Collaboration Suite (ZCS) versions 8.7.11, 8.8.7, 8.8.8, 8.8.9. Attacker gain: Ability to inject malicious JavaScript code to steal user data or perform unauthorized actions. Recommended action: Update ZCS to version 8.8.9 or later, or apply the provided patch.Exploited30% likelyExploit codeNucleiDetection
- 6.1MediumFeb 9, 2022Synacor Zimbra Collaborate Suite (ZCS) XSSCVE-2022-24682(1) The Synacor Zimbra Collaborate Suite (ZCS) is affected. (2) An attacker gains the ability to inject malicious scripts, potentially stealing user data or taking control of user sessions. (3) Apply the latest security patches for ZCS to mitigate this vulnerability.Exploited31% likelyExploit codeNucleiDetection
- 9.8CriticalMay 29, 2019Synacor Zimbra Collaboration Suite (ZCS)CVE-2019-96701. Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 12 and 8.7.11 Patch 25 is affected. 2. An attacker gains remote code execution and access to sensitive data. 3. Update to version 8.8.15 Patch 12 or 8.7.11 Patch 25.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
Top products
- Zimbra Collaboration Suite (ZCS)4 CVEs in the last year, 4 exploited
- Zimbra Collaboration Suite2 CVEs in the last year, 1 critical, 1 exploited
- Zimbra Collaboration2 CVEs in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- ENISA EUVD · Oct 29, 2026EUVD-2026-112942 · Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply…CVE-2026-66912
- ENISA EUVD · Oct 29, 2026EUVD-2026-112941 · Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email…CVE-2026-66911
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.