Synacor — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Synacor with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 19 Synacor vulnerabilities confirmed as exploited in the wild across 4 products; 6 of them (32%) are flagged as used in known ransomware campaigns. Zimbra Collaboration Suite (ZCS) is the most-affected product, with 16 entries (84% of the total). CISA added 5 entries in 2026 so far, compared with 4 in 2025. Across the 19 entries with an NVD CVSS score (100% of the total), the average score is 7.8; 6 entries are rated critical by NVD. The most recent addition is CVE-2026-73570 (Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability), added on 2026-08-21.
Affected products
| Product | Entries | Share |
|---|---|---|
| Zimbra Collaboration Suite (ZCS) | 16 | 84% |
| Zimbra Collaboration Suite | 1 | 5.3% |
| Zimbra Collaboration Suite (ZCS) | 1 | 5.3% |
| Zimbra Collaborate Suite (ZCS) | 1 | 5.3% |
Entries added per year
By date added to the KEV catalog
Exploited Synacor vulnerabilities (19)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2026-73570 | Zimbra Collaboration Suite (ZCS) | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | 2026-08-21 | — | HIGH8.9 |
| CVE-2025-48700 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | 2026-04-20 | — | MEDIUM6.1 |
| CVE-2025-66376 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability | 2026-03-18 | — | HIGH7.2 |
| CVE-2020-7796 | Zimbra Collaboration Suite | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability | 2026-02-17 | — | CRITICAL9.8 |
| CVE-2025-68645 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | 2026-01-22 | — | HIGH8.8 |
| CVE-2025-27915 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | 2025-10-07 | — | MEDIUM5.4 |
| CVE-2019-9621 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability | 2025-07-07 | — | HIGH7.5 |
| CVE-2024-27443 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 2025-05-19 | — | MEDIUM6.1 |
| CVE-2023-34192 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 2025-02-25 | — | CRITICAL9.0 |
| CVE-2024-45519 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability | 2024-10-03 | — | CRITICAL10.0 |
| CVE-2023-37580 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 2023-07-27 | — | MEDIUM6.1 |
| CVE-2022-27926 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 2023-04-03 | — | MEDIUM6.1 |
| CVE-2022-41352 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | 2022-10-20 | Known | CRITICAL9.8 |
| CVE-2022-27925 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | 2022-08-11 | Known | HIGH7.2 |
| CVE-2022-37042 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability | 2022-08-11 | Known | CRITICAL9.8 |
| CVE-2022-27924 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability | 2022-08-04 | Known | HIGH7.5 |
| CVE-2018-6882 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 2022-04-19 | Known | MEDIUM6.1 |
| CVE-2022-24682 | Zimbra Collaborate Suite (ZCS) | Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability | 2022-02-25 | Known | MEDIUM6.1 |
| CVE-2019-9670 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | 2022-01-10 | — | CRITICAL9.8 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.