Synacor Zimbra Collaboration Suite (ZCS) known exploited vulnerabilities
We track 19 CVEs in Synacor Zimbra Collaboration Suite (ZCS). All of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2022–2026). CISA flags 6 of them as used in ransomware campaigns. The most recent is CVE-2026-73570, added to KEV on .
Also listed as: Zimbra Collaborate Suite (ZCS) · Zimbra Collaboration Suite. CISA, NVD and vendor advisories name the same product differently; each CVE page keeps the wording from its source.
- CVEs tracked
- 19
- On CISA KEV
- 19
- Ransomware use
- 6
- Rated critical
- 6
Every Synacor Zimbra Collaboration Suite (ZCS) CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-73570 Zimbra ZCS SNMP Command Injection — Unauthenticated RCEwrite-up | [ HIGH ] | 8.9 | 71.7% | ||
| CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | [ MEDIUM ] | 6.1 | 1.7% | ||
| CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability | [ HIGH ] | 7.2 | 20.2% | ||
| CVE-2020-7796 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability | [ CRITICAL ] | 9.8 | 84.4% | ||
| CVE-2025-68645 Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | [ HIGH ] | 8.8 | 48.9% | ||
| CVE-2025-27915 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | [ MEDIUM ] | 5.4 | 4.1% | ||
| CVE-2019-9621 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability | [ HIGH ] | 7.5 | 81.0% | ||
| CVE-2024-27443 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 24.6% | ||
| CVE-2023-34192 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | [ CRITICAL ] | 9.0 | 77.3% | ||
| CVE-2024-45519 Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability | [ CRITICAL ] | 10.0 | 99.9% | ||
| CVE-2023-37580 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 49.1% | ||
| CVE-2022-27926 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 17.6% | ||
| CVE-2022-41352 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 95.5% | ||
| CVE-2022-37042 Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 91.9% | ||
| CVE-2022-27925 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerabilityransomware use | [ HIGH ] | 7.2 | 98.7% | ||
| CVE-2022-27924 Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerabilityransomware use | [ HIGH ] | 7.5 | 93.9% | ||
| CVE-2018-6882 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerabilityransomware use | [ MEDIUM ] | 6.1 | 29.8% | ||
| CVE-2022-24682 Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerabilityransomware use | [ MEDIUM ] | 6.1 | 30.9% | ||
| CVE-2019-9670 Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | [ CRITICAL ] | 9.8 | 100.0% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/synacor.json.
Our Synacor Zimbra Collaboration Suite (ZCS) coverage
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.